Fix ui.isAccessAllowed when undefined to prevent access

[dcousens]

• Fixes GHSA-9cvc-v7wm-992c

Please see the security vulnerability report for an up-to-date description and work-around if you can't update.

What happened

The default AdminUI middleware prevents access to the AdminUI if

• a session strategy configuration has been defined, and
• context.session is undefined or falsey

This is not what happens for the adminMeta GraphQL query, which falls back on public access when isAccessAllowed is undefined.

The GraphQL and AdminUI middleware behaviour should be the same.
We haven't committed or documented what the behaviour should be, so what we fall back on is open ended.

In this pull request, I have opted to fall back to the same behaviour as the default Admin UI middleware, as the behaviour that users would have observed and probably expect.

[dcousens]

Maybe in the near future, we should drop the isAccessAllowed default, and instead update the types (or validation errors) to ensure that isAccessAllowed is always defined if a session is defined.