Clarity around whether providing a value for an undefined variable is allowed

We just discovered a bug in an app that uses GraphQL where we used an incorrect name to pass a variable's value to a query (specifically, we passed a value as a variable rather than as a field of that name on another variable). I had thought that passing a variable not defined in the query document would be an error and was surprised that it wasn't.

After testing implementations and a careful reading of the spec, I came to the conclusion that the implementation matches the spec, but that this is very implicit in the spec: nothing ever iterates over the given variableValues.

(On the other hand, `codemirror-graphql` does [flag this as an error](https://github.com/graphql/codemirror-graphql/blob/8eb09936177f5106fde9251bbf460151dbb27de1/src/variables/lint.js#L74-L78) which is probably why I thought it was an error.)

My question is: is the current state of the spec and (non-`codemirror-graphql`) implementations intentional or an oversight?

If intentional, I would like to follow this up with a PR adding a sentence to section 2.10 explicitly noting that it is not an error to provide values for undefined variables. If an oversight, I can file an RFC to make it an error.

(There is probably some subtlety around "variables that aren't defined anywhere in the query document" and "variables that aren't defined in the operation currently being invoked".)