Feature Request: Hiding unauthenticated fields/types from introspection schema

This is somewhat related to #1, but different enough that it probably warrants a separate issue.

Say you have the following schema in a Cognito-authenticated AppSync api:
```graphql
type Query {
posts: [Post]!
}

type Mutation {
addPost(id: ID!, content: String!): Post
@aws_auth(cognito_groups : [ "editors" ])
}
```

With appsync as it currently stands, if you were to run the following query with a cognito user that's _not_ in the editors group:
```graphql
{
__schema {
types {
name
fields {
name
}
}
}
}
```

you would still be able to see the `addPost` field on the `Mutation` type, even though if you actually tried to run the `addPost` mutation, you would get a 401 error.

It would be nice if the introspection schema _only_ showed fields that you would have permission to query.

The issue provides no repository files or tests; start by reviewing the GraphQL introspection query and the @aws_auth Cognito-group example. Done means an unauthenticated or unauthorized user sees only the fields and types they can query in the introspection schema.

Written by the indexing model from the issue text.