Monitoring data can now be stored in `metrics-*` patterns when collected through elastic-agent. [Our documentation](https://www.elastic.co/guide/en/kibana/current/monitoring-data.html) recommends to use the `monitoring_user` role to view the data in Stack Monitoring application but that role does not have permissions to read from the metrics pattern.

`monitoring_user` should be allowed the same permissions on `metrics-*` as `.monitoring-*`
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/RBACEngineTests.java
new RBACAuthorizationInfo(role, Role.builder(RESTRICTED_INDICES, "authenticated_role").build()).hashCode();
        new RBACAuthorizationInfo(role, null).hashCode();
    }
    public void testGetUserPrivilegesThrowsIaeForUnsupportedOperation() {
        final RBACAuthorizationInfo authorizationInfo = mock(RBACAuthorizationInfo.class);
        final Role role = mock(Role.class);
        when(authorizationInfo.getRole()).thenReturn(role);
        when(role.cluster()).thenReturn(ClusterPermission.NONE);
        when(role.indices()).thenReturn(IndicesPermission.NONE);
        when(role.application()).thenReturn(ApplicationPermission.NONE);
        when(role.runAs()).thenReturn(RunAsPermission.NONE);
        when(role.remoteIndices()).thenReturn(RemoteIndicesPermission.NONE);
        final UnsupportedOperationException unsupportedOperationException = new UnsupportedOperationException();
        switch (randomIntBetween(0, 4)) {
            case 0 -> when(role.cluster()).thenThrow(unsupportedOperationException);
            case 1 -> when(role.indices()).thenThrow(unsupportedOperationException);
            case 2 -> when(role.application()).thenThrow(unsupportedOperationException);
            case 3 -> when(role.runAs()).thenThrow(unsupportedOperationException);
            case 4 -> when(role.remoteIndices()).thenThrow(unsupportedOperationException);
            default -> throw new IllegalStateException("unknown case number");
        }
        final PlainActionFuture<GetUserPrivilegesResponse> future = new PlainActionFuture<>();
        engine.getUserPrivileges(authorizationInfo, future);
        final IllegalArgumentException e = expectThrows(IllegalArgumentException.class, future::actionGet);
        assertThat(
            e.getMessage(),
            equalTo(
                "Cannot retrieve privileges for API keys with assigned role descriptors. "
                    + "Please use the Get API key information API https://ela.st/es-api-get-api-key"
            )