Add a note in make-extend-schema-plugin docs - JS doesn't bypass security.

See discord chat

"Hi, I'm trying to implement a register form, users should only can see their user by calling userById() query.

but in my custom mutation registerUser I need to know if user already registered or not.
[default-role](https://www.graphile.org/postgraphile/default-role/) states:

> So the default_role should have restricted privileges to only your data that is publicly accessible.

as my users table is not public, how can I implimnet my mutation?"

**"The JS is not permitted to bypass the security (that's why PostGraphile can be so secure); so you'll need to call a small security definer function from your schema extension."**

Lee la documentación de make-extend-schema-plugin y localiza la sección que trata sobre las extensiones de esquema y la seguridad. Añade una nota que explique que JavaScript no elude la seguridad de la base de datos y que para este caso de uso se necesita una pequeña security definer function. Se considera hecho cuando la guía aborda claramente el escenario de register mutation.

Escrito por el modelo de indexación a partir del texto del issue.