We need to enforce limits on what a single GraphQL query is allowed to do with regards to e.g. the total number of entities loaded within a single request. This needs to be taken into account for any tickets involving new GraphQL functionality: for T404692 we want to define a limit on how many entities can be loaded in a single request, for T403576 we need to define how many searches can be done in a single request, etc.