GraphQL G1: server HTTP binding, limits and request context #1583

Part of #1581. Depends on G0.

GraphQL-over-HTTP binding in GraphqlServerAdapter:

• POST for all operations; GET for queries only when enabled (off by default); mutations over GET get 405 with Allow: POST.
• application/json request bodies; other media types get 415. JSON arrays (batching) get 400, never executed.
• Response negotiation: application/graphql-response+json preferred, application/json for legacy clients, 406 otherwise.
• Status codes: with graphql-response+json, 400 for unparsable JSON, missing query, parse or validation errors and 200 once execution starts; with application/json, 200 for any well-formed request.
• operationName required when the document has several operations.
• Limits: maxRequestBytes (1 MiB) before parsing; parser token, character and depth limits through per-execution ParserOptions (never the process-wide defaults).
• Request context: GraphQLContext keys for the Restlet Request and ClientInfo, not settable from caller extensions; an ExecutionInput customizer for DataLoaderRegistry, locale, etc.
• Configuration frozen after the first request.