Add GraphQL authentication security reference documentation

[Copilot]

Adds security testing reference material for GraphQL authentication flaws to the pentest knowledge base.

New Documentation (docs/graphql-security-reference.md)

• BOLA/IDOR — Missing per-field authorization on queries
• JWT Algorithm Confusion — alg: none and weak signature attacks
• Token Leakage — GET requests exposing tokens in logs
• Fragment/Alias Bypasses — Object-level auth circumvention
• Rate Limit Testing — Login mutation brute-force checks

Includes remediation strategies for Apollo/Hasura/AppSync:

type Query {
  user(id: ID!): User @auth(requires: [OWNER, ADMIN])
}

README Update

Added "Security Reference Guides" section linking to the new GraphQL documentation.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.