This makes our authorization calls available to all GraphQL mutations
without the additional step of including the module first.

Since the `GraphQL::ID_TYPE` usages should represent globally unique
ids, this changes some fields for which this is not the case into
strings.

The `ID_TYPE` is a specialised, so this change should be backwards
compatible.

https://graphql-ruby.org/type_definitions/scalars.html

And fix the tests so that it won't run into circular paths.

Partially addresses #47424.

This is mainly the setup of mutations for GraphQL. Including
authorization and basic return type-structure.