Fix token validation on graphql IntrospectionQuery

[Weiko]

Context

We recently introduced a change that now throws a 401 if the token is invalid or expired. The first implementation is using an allow list and 'IntrospectionQuery' was missing so the playground was broken.

The check has been updated and we now only check the excludedOperations list if a token is not present. This is because some operations can be both used as loggedIn and loggedOut so we want to validate the token for those sometimes (and set the workspace, user, cache version, etc). Still not a very clean solution imho.