fix: Disable GraphQL introspection in prod

[suejung-sentry]

Disable GraphQL introspection in production environments to resolve pentest finding.
Tested by confirming in local that the introspection query succeeds/fails by changing the var in settings_{env}.py

Closes https://github.com/codecov/internal-issues/issues/917

Example introspection query:

query IntrospectionQuery {
  __schema {
    queryType {
      name
    }
    mutationType {
      name
    }
    types {
      name
      kind
      description
      fields(includeDeprecated: true) {
        name
        description
        args {
          name
          description
          type {
            name
            kind
            ofType {
              name
              kind
            }
          }
          defaultValue
        }
        type {
          name
          kind
          ofType {
            name
            kind
          }
        }
        isDeprecated
        deprecationReason
      }
      inputFields {
        name
        description
        type {
          name
          kind
          ofType {
            name
            kind
          }
        }
        defaultValue
      }
      interfaces {
        name
        kind
      }
      enumValues(includeDeprecated: true) {
        name
        description
        isDeprecated
        deprecationReason
      }
      possibleTypes {
        name
        kind
      }
    }
    directives {
      name
      description
      locations
      args {
        name
        description
        type {
          name
          kind
          ofType {
            name
            kind
          }
        }
        defaultValue
      }
    }
  }
}

example error:

{
  "error": {
    "errors": [
      {
        "message": "Cannot query '__schema': introspection is disabled.",
        "locations": [
          {
            "line": 2,
            "column": 3
          }
        ],
        "extensions": {
          "exception": null
        }
      }
    ]
  }
}

example testing in postman in prod before deploying this update

{
    "query": "query IntrospectionQuery { __schema { queryType { name } mutationType { name } types { name kind description fields(includeDeprecated: true) { name description args { name description type { name kind ofType { name kind } } defaultValue } type { name kind ofType { name kind } } isDeprecated deprecationReason } inputFields { name description type { name kind ofType { name kind } } defaultValue } interfaces { name kind } enumValues(includeDeprecated: true) { name description isDeprecated deprecationReason } possibleTypes { name kind } } directives { name description locations args { name description type { name kind ofType { name kind } } defaultValue } } } }",
    "variables": {}
}

[codecov-notifications]

Codecov Report

Attention: Patch coverage is 80.00000% with 1 line in your changes missing coverage. Please review.

✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
codecov/settings_staging.py	0.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[codecov]

Codecov Report

Attention: Patch coverage is 80.00000% with 1 line in your changes missing coverage. Please review.

Project coverage is 96.24%. Comparing base (564cad4) to head (55229a8).
Report is 2 commits behind head on main.

✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
codecov/settings_staging.py	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #953      +/-   ##
==========================================
- Coverage   96.24%   96.24%   -0.01%     
==========================================
  Files         826      826              
  Lines       19016    19021       +5     
==========================================
+ Hits        18302    18306       +4     
- Misses        714      715       +1     

Flag	Coverage Δ
unit	92.49% <80.00%> (-0.01%)	⬇️
unit-latest-uploader	92.49% <80.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.