feat(graphql): granular permissions

[andrewazores]

Fixes #1021

• chore(permissions): extract PermissionedAction interface
• chore(graphql): mark all fetchers/mutators with resource actions
• feat(graphql): implement permissions check for each graphql fetcher/mutator
• fix(graphql): ensure GraphQLContext is not null by copying DataFetchingEnvironment
• chore(graphql): apply spotless formatting

This implements granular permissions for each fetcher/mutator within the GraphQL endpoint implementation. This is achieved by removing the endpoint-level resource actions set union - by default, only a basic "token is valid" check will be performed - and delegating further permissions checks to each subsequent or nested fetcher/mutator that is executed afterward. In this implementation, each such subquery that is performed will result in a permissions check being performed, checking that the contextual user has the required permissions for the subquery's action. For complex GraphQL queries with deep nesting, this might add noticeable overall request latency since there is an authentication server request round-trip-time at each level of nested query. This might be something to optimize in the future by pre-computing the set union by recursing through the nested queries up front and performing a single permissions check all at once before actually executing the queries, but this needs either some deeper knowledge of GraphQL to pull off or a more complex implementation of AbstractPermissionedDataFetcher that encodes the nested query relationships.

Overall this ends up implementing something very similar to how our HTTP API permissions checks work with the AbstractAuthenticatedRequestHandler/AbstractV2RequestHandler, but on the DataFetchers.

Unit tests are still overall sorely lacking - see #947. There is some basic integration test coverage, at least, which caught an error during implementation where the DataFetchingEnvironment passed to subqueries contained a null GraphQLContext.

[andrewazores]

@ebaron ping

[ebaron]

@ebaron ping

Hey Andrew, sorry I completely missed this PR. I'll take a look today.

[ebaron]

Looks good!