Gateway query complexity analysis

We need to apply complexity limits to our gateway layer to prevent executions of malicious queries.

The problem:
Some Graphql queries can be very expensive to resolve in three ways:

• The query is highly nested (imagine the "small world" problem of every person being separated only by 5 connections away)
• The query requests too many objects (imagine if a single query requests 1000 individual programs by id)
• The query causes unnecessary calls to upstream services for the same data

Because of this, traditional rate-limits alone will not protect our system from DOS attacks, as a single expensive query has the ability to put heavy strain on the system.

The solution:

• Query depth limit (https://github.com/stems/graphql-depth-limit)
• Field-level score-based complexity limit (https://www.npmjs.com/package/graphql-cost-analysis)
• Use data loader for reading from upstream services (technically not a part of complexity analysis but should be a standard anyway to protect upstream services from unnecessary heavy loads) (https://github.com/graphql/dataloader)

Applying complexity analysis on the queries prevents expensive queries from being executed at all before it reaches our resolvers.

We'll start with arbitrary depth and complexity limits, then log out the metrics to see what our normal usage is like, then can adjust later in production to better reflect real-world requirements. It's more important to have the gateway set up for it.