Check (and document) the permissions we require

Cluster monitor requires read-only admin perms, however I don't think this is documented anywhere.

While we're at it, we should also check for the required perms at cluster add time, to avoid confusing error messages later down the line.