Whitelisting query root fields rather than blacklisting

### Is your proposal related to a problem?

It’s not a problem per-se, but I want my graphql schema to be as locked down as it possibly could be to make the app function, but since all query root fields are by default enabled, it by default opens everything up.

### Describe the solution you'd like

An option to have query_root_fields: [] set for all tables by default.

### Describe alternatives you've considered

Just remembering to set it all the time. Or maybe a lint rule on the YAML files to detect missing keys

Start by tracing how query_root_fields is read from the YAML configuration and how default query root fields are enabled for tables. Determine where a global default could be represented, then verify that explicitly configured fields still work and that an empty default locks down query roots as requested.

Written by the indexing model from the issue text.