Authentication mechanism should be configurable

Problem/Motivation

By default, GraphQL allows all the autentication methods allowed by the system. Due to this, API end-points are accessible by any authentication allowed at the system-level.

// file: ./graphql/src/RouteProvider.php:
// Allow all authentication providers by default.
$auth = array_keys($this->authenticationCollector->getSortedProviders());

Steps to reproduce

After installation, all authentication mechanism is allowed, not just what is implemented.

Proposed resolution

Create a config that will:

1. List all the system-wide authentication methods that are enabled
2. Allow user to select authentication that she wants. Default should be all methods enabled, to conform to existing functionality

Note: Do we require per end-point API level authentication? Suggestion: simpler solution is to allow a super-set of all the authentication mechanism supported by application. Mapping endpoint to authentication-mechanism in the config may have difficult UX, future-proofing may be hard.

Remaining tasks

User interface changes

API changes

Data model changes