Validate `access` property

[ruudk]

Q	A
Bug report?	no
Feature request?	yes
BC Break report?	no
RFC?	no
Version/Branch	v0.12.5

When using the access property it's very easy to make mistakes. It wants to have a boolean value or expression language string. But when you forget to prefix your expression with @= the string value will result to true, granting access.

Two problems:

1. It should use strict comparison access === true and not access == true.
2. It should only accept true, false, or string starting with @=

[ruudk]

I found out that there is a check for the AnnotationParser:

GraphQLBundle/src/Config/Parser/AnnotationParser.php

Lines 821 to 824 in b12cf51

	private static function formatExpression(string $expression)
	{
	return '@=' === \substr($expression, 0, 2) ? $expression : \sprintf('@=%s', $expression);
	}

But we don't use annotations, we use YAML.

This field definition:

            hash:
                type: 'String'
                access: "value.hasAccess(getUser())"

resolves to this generated GraphQL PHP file:

                'hash' => [
                    'type' => Type::string(),
                    'args' => [
                    ],
                    'resolve' => null,
                    'deprecationReason' => null,
                    'complexity' => null,
                    # public and access are custom options managed only by the bundle
                    'public' => null,
                    'access' => function () use ($globalVariable) {
                        return 'value.hasAccess(getUser())';
                    },
                    'useStrictAccess' => true,
                ],

As you can see, access returns a closure that returns a string.

When I change the field definition to:

            hash:
                type: 'String'
                access: "@=value.hasAccess(getUser())"

the PHP file will become correct:

                'hash' => [
                    'type' => Type::string(),
                    'args' => [
                    ],
                    'resolve' => null,
                    'deprecationReason' => null,
                    'complexity' => null,
                    # public and access are custom options managed only by the bundle
                    'public' => null,
                    'access' => function ($value, $args, $context, ResolveInfo $info, $object) use ($globalVariable) {
                        return $value->hasAccess(\Overblog\GraphQLBundle\ExpressionLanguage\ExpressionFunction\Security\Helper::getUser($globalVariable));
                    },
                    'useStrictAccess' => true,
                ],