Add GraphQL API evidence gates

[xianzuyang9-blip]

Summary

• Closes [REVIEW] api-security: add GraphQL batching, alias, and persisted-query evidence gates #1553
• Adds GraphQL operation-control evidence gates to api-security.
• Requires reviewers to preserve proof for operation count, alias limits, depth, complexity, resolver cost overrides, persisted-query enforcement, subscription limits, and federation parity.
• Adds focused persisted-query bypass and resolver-cost underpricing examples.

Verification

• git diff --check
• rg -n "GraphQL Operation-Control|Persisted Query Bypass|Resolver Cost|Alias limits|Federation parity|unknown hashes" skills/appsec/api-security/SKILL.md

Bounty

/claim #1553

Preferred payment method: crypto or PayPal after maintainer acceptance.