[GraphQL] GraphQL surface checks

[emmanuelgautier]

Description

Protocol-hygiene checks for GraphQL endpoints.

Checks to implement

• Introspection enabled in production
• GraphiQL / Apollo Sandbox exposed
• Field suggestion leakage (Clairvoyance-style)
• CSRF over GET / form-encoded queries
• Anonymous field access (no credentials)
• Endpoint discovery & fingerprinting

Tier rationale

Single-request protocol/config probes, no cross-user comparison.