chore(cms): replace graphql-depth-limit with maintained alternative

[Kneesal]

Background

The graphql-depth-limit@1.1.0 package is unmaintained (7+ years, repository deleted). It crashes on fragment spreads within dynamic-zone unions (reads .kind on undefined nodes). Currently worked around with depthLimit: 100 in apps/cms/config/plugins.ts, which effectively disables DoS protection.

Raised in PR #443 review: #443

Expected outcome

Strapi GraphQL plugin uses a maintained depth-limiting library that correctly handles fragment spreads in unions, with a reasonable depth limit (10–15) restoring DoS protection.

Acceptance criteria

• Replace graphql-depth-limit with @graphile/depth-limit (or equivalent maintained library)
• Lower depthLimit to a reasonable value (10–15)
• Verify fragment spreads in dynamic-zone unions work without crashing
• Remove the workaround comment in apps/cms/config/plugins.ts

Possible solution(s)

1. Check if upgrading @strapi/plugin-graphql to latest resolves the dependency
2. If not, use pnpm overrides to swap graphql-depth-limit for @graphile/depth-limit
3. Custom Strapi middleware to replace the built-in depth validation

References

• PR feat(web,cms): add quiz-button section component #443 CodeRabbit review comment
• https://github.com/graphile/depth-limit