Tweak default security

[tobias-tengler]

• Enable FieldCycleDepthRule regardless of environment to avoid surprises when switching environments
• Allow specific requests to request the Fusion Operation Plan even if it's generally not allowed

[Copilot]

Pull request overview

Adjusts HotChocolate’s default security behavior to be consistent across environments and adds a per-request escape hatch for returning Fusion operation plans even when globally disallowed.

Changes:

• Always enable AddMaxAllowedFieldCycleDepthRule() under default security (no longer environment-gated).
• Add per-request override support to allow returning a Fusion operation plan when Fusion-Operation-Plan: 1 is sent, even if FusionRequestOptions.AllowOperationPlanRequests is false.
• Add/adjust test coverage and snapshots for the new default-security and operation-plan behaviors.

Reviewed changes

Copilot reviewed 10 out of 13 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/HotChocolate/Fusion/src/Fusion.AspNetCore/DependencyInjection/FusionServerServiceCollectionExtensions.cs	Enables field-cycle-depth validation rule unconditionally when default security is on.
src/HotChocolate/AspNetCore/src/AspNetCore/Extensions/HotChocolateAspNetCoreServiceCollectionExtensions.cs	Enables field-cycle-depth validation rule unconditionally when default security is on.
src/HotChocolate/Fusion/src/Fusion.Execution/Execution/Extensions/FusionRequestContextExtensions.cs	Adds per-request override check to allow operation plan requests.
src/HotChocolate/Fusion/src/Fusion.Execution/Execution/OperationPlanRequestOverrides.cs	Introduces internal feature record to represent per-request operation plan allowance.
src/HotChocolate/Fusion/src/Fusion.Execution/Execution/Extensions/OperationPlanRequestOverridesExtensions.cs	Adds OperationRequestBuilder.AllowOperationPlanRequest() extension to set the per-request override.
src/HotChocolate/Fusion/test/Fusion.AspNetCore.Tests/FusionTestBase.cs	Extends test helper to pass through disableDefaultSecurity into gateway server setup.
src/HotChocolate/Fusion/test/Fusion.AspNetCore.Tests/DefaultSecurityTests.cs	Updates/expands Fusion default security tests, including operation-plan allow/deny and per-request override behavior.
src/HotChocolate/Fusion/test/Fusion.AspNetCore.Tests/snapshots/*.snap	Adds snapshots for the new Fusion operation-plan request scenarios.
src/HotChocolate/AspNetCore/test/AspNetCore.Tests/DefaultSecurityTests.cs	Adds AspNetCore default security tests covering introspection and field-cycle-depth enforcement.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.