JWT scope verification based on query or mutation in the body

[stevehu]

Now the graphql-security only verify the signature of the JWT token and checks if the token is expired. Given there is no OpenAPI specification to defined the scope for each endpoint. Actually, we only a single endpoint for graphql. In order to control who can run query and who can run mutation, we can parse the body to check the request type and then apply seviceId.r or serviceId.w to each request. This is based on the convention instead of specification. Also, this relies on a parser of body to work.