Security: GraphViewSet bypasses RalphPermission and PermissionsForObjectFilter (CWE-862)

## Summary

The `GraphViewSet` in the dashboards API uses the base DRF `ReadOnlyModelViewSet` instead of `RalphReadOnlyAPIViewSet`, bypassing all authorization checks that every other API viewset enforces.

## Vulnerability Details

**File:** `src/ralph/dashboards/api/views.py` (line 7)

```python
class GraphViewSet(ReadOnlyModelViewSet): # Wrong base class
queryset = Graph.objects.filter(active=True)
```

Every other ViewSet in the codebase uses `RalphAPIViewSet` or `RalphReadOnlyAPIViewSet`, which enforce:
1. `RalphPermission` - Django admin permissions + staff-only check
2. `PermissionsForObjectFilter` - Object-level access control

The `RalphAPIViewSetMixin.__init__` (line 91-96 in `api/viewsets.py`) validates these are present:
```python
if RalphPermission not in self.permission_classes:
raise AttributeError("RalphPermission missing in permission_classes")
```

But `GraphViewSet` bypasses this entirely by not inheriting from the Ralph base class.

## Fix

Change the base class:
```python
from ralph.api.viewsets import RalphReadOnlyAPIViewSet

class GraphViewSet(RalphReadOnlyAPIViewSet):
queryset = Graph.objects.filter(active=True)
```

## CWE

- CWE-862: Missing Authorization

## Severity

Medium - Any authenticated user (not necessarily staff) can list and read all active graph configurations.