Forward the User's ID to Hasura when making requests from the Node backend

[Free Wortley]

This is important because it prevents IDORs due to the Confused Deputy problem instead of us relying on properly querying for if the user is authorized every time. It's possible to set the X-Hasura-Real-User-Id header or we can forward the user's JWT directly.

For example:

query GetUsersProjects($user_id: uuid!) {
    projects(where: {organization: {organization_users: {user: {kratos_id: {_eq: $user_id}}}}}) {
        id
    }
}

That can become:

query GetUsersProjects() {
    projects {
        id
    }
}

And it will still function the same.

[Free Wortley]

We should try to standardize our access to Hasura so that you have to call unsafeRunQueryAsAdmin(query) to opt-in to admin access.