Provide option for disabling field introspection with GraphQL

[bclozel]

Most GraphQL implementations allow field introspection by default or even consider it as part of the spec. Without this feature, clients relying on introspection (like GraphiQL) won't work.

As discussed in the OWASP guide, some consider that introspection allows attacker to learn about queries and data types. In this case, GraphQL clients should be given the schema out-of-band and rely on a different source of information to learn about the API.

The same guide argues that disabling introspection won't prevent attackers to learn about the API, since brute-forcing and GraphQL error hints will give the information away quite easily anyway.

Spring Boot should provide an option to disable introspection, but not enable it by default.