feat(graphql): allow to disable the introspection query

[epourail]

Q	A
Branch?	main
Tickets	-
License	MIT
Doc PR	api-platform/docs#1792

For security reason, the introspection query should be disabled to not expose the schema.
This PR allows to enable/disable the introspection query througth the bundle configuration:

api_platform:
  ...
  graphql:
    introspection:
      enabled: true # (or false)    
  ...

By default, the introspection is enabled to avoid BC and keep the current behavior.

TODO:

• update the documentation
• how to test ?

[epourail]

What do you think of this feature ? If ok with such improvment, I will update the documentation and test.

[alanpoulain]

You need to handle the case where $validationRules is null.

[epourail]

I updated the code to instantiate the rule globally for both reasons:

1. it will not create a new rule (new DisableIntrospection()) on each graphql query
2. the configuration yaml-file setup the bundle globally

... but the code is now in the constructor.

@alanpoulain are you ok with that or I keep the previous logic (create the rule in the executeQuery() method) ?

[alanpoulain]

I think it's a nice feature, thanks. I'm not sure you can write functional tests, but unit ones should be fine.

[alanpoulain]

Thank you @epourail!