Forward the User's ID to Hasura when making requests from the Node backend

[freeqaz]

This is important because it prevents IDORs due to the Confused Deputy problem instead of us relying on properly querying for if the user is authorized every time. It's possible to set the X-Hasura-Real-User-Id header or we can forward the user's JWT directly.

For example:

query GetUsersProjects($user_id: uuid!) {
    projects(where: {organization: {organization_users: {user: {kratos_id: {_eq: $user_id}}}}}) {
        id
    }
}

That can become:

query GetUsersProjects() {
    projects {
        id
    }
}

And it will still function the same.

[freeqaz]

We should try to standardize our access to Hasura so that you have to call unsafeRunQueryAsAdmin(query) to opt-in to admin access.