Add flag to enforce use of x-hasura-admin-secret for the /query endpoint

If I add admin to the `x-hasura-role` or `x-hasura-allowed-roles` in my token custom claims. I have unrestricted access to the Hasura instance.

Some users might add that role to have full access to their GraphQL schema. But not realize that this will give full access to the `/v1/query` where any SQL statement can be executed.

IMO Hasura should add a flag to force the use of the `x-hasura-admin-secret` to the `/v1/query` endpoint and enable it by default. Or disable the usage of the `admin` role without the `x-hasura-admin-secret`

Thanks