Implement query & depth restrictions on the GQL interface

[Voxelot]

https://async-graphql.github.io/async-graphql/en/depth_and_complexity.html

We need to implement limits on the complexity and depth of graphql queries to protect the APIs from DOS attacks. This will need to be done carefully, ensuring that the SDK isn't rendered unusable by excessive limits.