refactor type-graphql authorization

[yss14]

Motivation:
At the moment custom permission checks are solved via type-graphql middlewares and not the buildin auth checker functionality. This brings some disadvantages, like not being able to use buildin error handling behaviour and failing silently as proposed here.

Acceptance Criteria:

• protected queries, mutations, and fields are decorated by the buildin type-graphql decorators
• custom auth checker checks desired permissions
• current workarounds are resolved where both errors and data is returned by a graphql query (e.g. feature: share settings see other users as member #2520)

Authoriztation Docs