Security - disable gql introspection for non-auth user (#16047)

closes https://github.com/twentyhq/private-issues/issues/351
closes https://github.com/twentyhq/private-issues/issues/350

Before, introspection query works without token. After, fails.

```

query IntrospectionQuery {
  __schema {
    queryType {
      name
    }
    mutationType {
      name
    }
    subscriptionType {
      name
    }
    types {
      ...FullType
    }
    directives {
      name
      description
      locations
      args {
        ...InputValue
      }
    }
  }
}

fragment FullType on __Type {
  kind
  name
  description
  fields(includeDeprecated: true) {
    name
    description
    args {
      ...InputValue
    }
    type {
      ...TypeRef
    }
    isDeprecated
    deprecationReason
  }
  inputFields {
    ...InputValue
  }
  interfaces {
    ...TypeRef
  }
  enumValues(includeDeprecated: true) {
    name
    description
    isDeprecated
    deprecationReason
  }
  possibleTypes {
    ...TypeRef
  }
}

fragment InputValue on __InputValue {
  name
  description
  type {
    ...TypeRef
  }
  defaultValue
}

fragment TypeRef on __Type {
  kind
  name
  ofType {
    kind
    name
    ofType {
      kind
      name
      ofType {
        kind
        name
        ofType {
          kind
          name
          ofType {
            kind
            name
            ofType {
              kind
              name
              ofType {
                kind
                name
              }
            }
          }
        }
      }
    }
  }
}
```

packages/twenty-server/src/engine/core-modules/graphql/hooks/use-disable-introspection-for-unauthenticated-users.hook.ts

@@ -0,0 +1,17 @@
+import { type Plugin } from 'graphql-yoga';
+import { NoSchemaIntrospectionCustomRule } from 'graphql/validation/rules/custom/NoSchemaIntrospectionCustomRule';
+import { isDefined } from 'twenty-shared/utils';
+
+import { type GraphQLContext } from 'src/engine/api/graphql/graphql-config/graphql-config.service';
+
+export const useDisableIntrospectionForUnauthenticatedUsers = (
+  isProductionEnvironment: boolean,
+): Plugin<GraphQLContext> => ({
+  onValidate: ({ context, addValidationRule }) => {
+    const isAuthenticated = isDefined(context.req.workspace);
+
+    if (!isAuthenticated && isProductionEnvironment) {
+      addValidationRule(NoSchemaIntrospectionCustomRule);
+    }
+  },
+});