Enable bypassing persisted operations

[benjie]

Feature description

Add a function, like allowExplain, that governs whether a request may use arbitrary operations versus only persisted operations.

Motivating example

In development it's common to want to send arbitrary queries from GraphiQL whilst also enforcing Persisted Operations from the application.

app.use(postgraphile(DATABASE_URL, SCHEMAS, {
  allowUnpersistedOperation(req) {
    return process.env.NODE_ENV === "development" && req.headers.referer.endsWith("/graphiql");
  }
});

(Should we pass the operation too, I wonder?)

Breaking changes

None