Add a note in make-extend-schema-plugin docs - JS doesn't bypass security.

See discord chat

"Hi, I'm trying to implement a register form, users should only can see their user by calling userById() query.

but in my custom mutation registerUser I need to know if user already registered or not.
[default-role](https://www.graphile.org/postgraphile/default-role/) states:

> So the default_role should have restricted privileges to only your data that is publicly accessible.

as my users table is not public, how can I implimnet my mutation?"

**"The JS is not permitted to bypass the security (that's why PostGraphile can be so secure); so you'll need to call a small security definer function from your schema extension."**