Permissions can break GQL schema contract

### Version Information

Server Version: 2.16.1
CLI Version (for CLI related issue):

### Environment

OSS in k8s

### What is the current behaviour?

When a non null foreign key runs row level permission checks and finds that the user is unable to view the row the value returned is null even though the GQL schema says the field cannot be null. This breaks the GQL schema contract and all the assumptions about those fields. This breaks setups that might be using apollo federation support to use hasura as a subgraph since the GQL gateway is more strict about enforcing the GQL schema contract.

### What is the expected behaviour?

It should return a GQL error that the non-null field cannot return null and bubble the error up to the next nullable field like the GQL spec defines
https://spec.graphql.org/draft/#sel-FANTNNCAACKhCqoK
> Since Non-Null type fields cannot be null, field errors are propagated to be handled by the parent field. If the parent field may be null then it resolves to null, otherwise if it is a Non-Null type, the field error is further propagated to its parent field.

### How to reproduce the issue?

1. Create 2 tables one with a non null foreign key
2. Enable the relationship so it shows up in the GQL schema (non-null field)
3. Add permission check that does not allow the role to view the linked table rows
4. Query the field and see you get null back on a non-null field

### Screenshots or Screencast

Schema field showing non-null
Response returning null on non-null field

### Please provide any traces or logs that could help here.

Can give these over email if required

### Any possible solutions/workarounds you're aware of?

No, we discovered this issue when we started using hasura as an apollo federated subgraph where the GQL gateway is more strict about enforcing the GQL schema contract. Even though these responses gave back partial results the gateway realized the response was not a valid GQL response and so it raised the GQL error.

### Keywords

non-null, not-null, nullable, missing gql error, apollo federation

Start by reproducing the two-table case described in the issue: a non-null foreign key relationship whose linked rows are hidden by permissions. Read the GraphQL specification's non-null error propagation section and trace how the permission check handles the related field. Done means the response returns a GraphQL error and bubbles null to the next nullable field instead of violating the schema contract.

Written by the indexing model from the issue text.