Make `mergeAST` opt-in only

As per discussions with @IvanGoncharov, the [`utility/mergeAst`](https://github.com/graphql/graphiql/blob/master/src/utility/mergeAst.js) function looks like a good candidate for inclusion in `graphql-js` itself, however it shouldn't be mutating AST directly. Instead, we will refactor it to use the `visit` function to accomplish this, and then open a PR to `graphql-js`. This is just a placeholder for the forthcoming PR