[RFC] [gatsby-source-drupal]: Add useAuthOn option to specify which resources to use Auth on

[KyleAMathews]

Some Drupal resources can't be accessed unless you're authenticated. So it's common to add authentication to gatsby-source-drupal. But this has the unfortunate side-effect of slowing down access to public resources as now all API requests have to pass through the CDN to Drupal. The difference can be stark. @Auspicus tried disabling auth for his large (~70k entity) Drupal/Gatsby site and sourcing dropped 85% from ~200s to ~30s.

We could instead add a new option that lets you specify which resources need authentication. Then the source plugin could take advantage of CDN caching where possible and add authentication only when needed.

[Auspicus]

I think for BC support it would be best to default to using the auth credentials for all requests unless the useAuthOn parameter is passed. It's essentially an "Allow List" for authentication. The alternative would be a "Deny List". There's a choice to be made as to which we do (or both) but I think it's fair to go with the idea that for most people it will be one or two resources that require auth whilst the rest are public than the majority of your resources requiring auth.

I'm also not sure if permissions could affect which fields show on the resource. Something like the "Field Permissions" module might not play too well with this. I think relationships could be affected. It would be good to hear @larowlan take on this.