Monitoring data can now be stored in `metrics-*` patterns when collected through elastic-agent. [Our documentation](https://www.elastic.co/guide/en/kibana/current/monitoring-data.html) recommends to use the `monitoring_user` role to view the data in Stack Monitoring application but that role does not have permissions to read from the metrics pattern.

`monitoring_user` should be allowed the same permissions on `metrics-*` as `.monitoring-*`
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/RBACEngineTests.java
final PlainActionFuture<RoleDescriptorsIntersection> future = new PlainActionFuture<>();
        engine.getRoleDescriptorsIntersectionForRemoteCluster(
            randomValueOtherThan(concreteClusterAlias, () -> randomAlphaOfLength(10)),
            authorizationInfo,
            future
        );
        final RoleDescriptorsIntersection actual = future.get();
        assertThat(actual, equalTo(RoleDescriptorsIntersection.EMPTY));
    }
    public void testGetRoleDescriptorsIntersectionForRemoteClusterWithoutRemoteIndicesPermissions() throws ExecutionException,
        InterruptedException {
        assumeTrue("untrusted remote cluster feature flag must be enabled", TcpTransport.isUntrustedRemoteClusterEnabled());
        final String concreteClusterAlias = randomAlphaOfLength(10);
        final Role role = createSimpleRoleWithRemoteIndices(RemoteIndicesPermission.NONE);
        final RBACAuthorizationInfo authorizationInfo = mock(RBACAuthorizationInfo.class);
        when(authorizationInfo.getRole()).thenReturn(role);
        final PlainActionFuture<RoleDescriptorsIntersection> future = new PlainActionFuture<>();
        engine.getRoleDescriptorsIntersectionForRemoteCluster(
            randomValueOtherThan(concreteClusterAlias, () -> randomAlphaOfLength(10)),
            authorizationInfo,
            future
        );
        final RoleDescriptorsIntersection actual = future.get();
        assertThat(actual, equalTo(RoleDescriptorsIntersection.EMPTY));
    }
    public void testGetRoleDescriptorsForRemoteClusterForReservedRoles() {
        assumeTrue("untrusted remote cluster feature flag must be enabled", TcpTransport.isUntrustedRemoteClusterEnabled());
        final ReservedRolesStore reservedRolesStore = new ReservedRolesStore();
        final FieldPermissionsCache fieldPermissionsCache = new FieldPermissionsCache(Settings.EMPTY);