Introspection: require authorization

[Authorization | GraphQL](https://graphql.org/learn/authorization/) talks about delegating authorization logic to the business logic layer. This makes sense to me for most things. One thing I'm not sure on though is how can I lock down introspection if I want to have a tool in production where most people can't use it (for security reasons) but software engineers, product managers, operators, and possibly others who I configure can use introspection so that tools they use (e.g. a hosted GraphiQL or GraphQL Playground app to make queries and even some mutations) will work out of the boxy without needing a schema registry or anything.

Is there a straight forward way to hook into the out-of-the-box introspection tooling in `graphql-js` to run introspection like normal if my user is authorized to do so but return error(s) otherwise?

El issue no menciona archivos del repositorio ni pruebas. Empieza leyendo la guía de autorización de GraphQL enlazada e investigando el comportamiento de introspection de graphql-js; el trabajo estaría terminado cuando exista una forma clara y compatible de permitir introspection a los usuarios autorizados y devolver errores para los demás.

Escrito por el modelo de indexación a partir del texto del issue.