Restrict `explain` to the master key

[mstniy]

New Feature / Enhancement Checklist

• I am not disclosing a vulnerability.
• I am not just asking a question.
• I have searched through existing issues.

Current Limitation

Currently, any user is able to run a query with the explain parameter and obtain the raw result returned by MongoDB. This discloses too much information to the clients, nor is it of great utility to them.

Feature / Enhancement Description

The use of the explain parameter should be restricted to the master key. We can use the deprecator to shift to the new behavior gradually.

Example Use Case

n/a

Alternatives / Workarounds

n/a

3rd Party References

n/a

[mtrezza]

Thanks for opening this issue!

Makes sense to me, would you want to open a PR for this?