fix: leave invalid variables to the executor under limitQueryComplexity()

[oojacoboo]

Problem

Psr15GraphQLMiddlewareBuilder::limitQueryComplexity() registers webonyx's QueryComplexity rule. To price fields by their arguments, that rule coerces the operation's variables during validation (Values::getVariableValues() in buildFieldArguments() and directiveExcludesField()). When a variable fails coercion, for example a custom scalar's parseValue() refusing a value, it throws one Error whose message joins every coercion message with "\n\n", without locations.

That preempts the executor, which would refuse the same variables a moment later (CoerceVariableValues, before any resolver runs) with one error per variable, each with its location and the usual Variable "$x" got invalid value ... message. So any server using limitQueryComplexity() loses per-variable coercion errors.

Fix

TheCodingMachine\GraphQLite\Validator\Rules\QueryComplexity extends webonyx's rule (it has to stay a subclass, since GraphQL::promiseToExecute() only hands raw variables to instanceof QueryComplexity rules) and wraps the parent's Document leave callback:

• On a thrown GraphQL\Error\Error, it checks whether the raw variables really fail coercion against the document's variable definitions. If they do, it reports nothing and the executor refuses them per variable. Otherwise it rethrows, so an unrelated error can't disable the limit.
• The operation name isn't known during validation, so for multi-operation documents the error is only dropped when every operation's own variable definitions fail coercion. Whichever operation runs, the executor refuses it.
• Valid operations pay no extra coercion; the check only runs after a throw.

limitQueryComplexity() now registers this rule. Users who add webonyx's rule with addValidationRule() can switch to this class.

Forward compatibility

Only public webonyx API is used: getVisitor(), getRawVariableValues(), Values::getVariableValues() and the public AST. If a future webonyx version stops exposing a Document leave callback, the parent visitor is returned unchanged, which degrades to today's behavior.

Tests

• An invalid custom scalar variable is refused by the executor with its location; two invalid variables give two errors.
• Valid operations over and under the limit are refused and executed as before.
• An unrelated Error thrown while pricing is not swallowed.
• An invalid variable belonging to a different operation of the document keeps the limit in place.
• Integration test through the GraphQLite fixture schema with an invalid Int variable.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 88.46154% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 92.06%. Comparing base (53f9d49) to head (c9df0b9).
⚠️ Report is 179 commits behind head on master.

Files with missing lines	Patch %	Lines
src/Validator/Rules/QueryComplexity.php	88.46%	3 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##             master     #839      +/-   ##
============================================
- Coverage     95.72%   92.06%   -3.67%     
- Complexity     1773     2169     +396     
============================================
  Files           154      205      +51     
  Lines          4586     5772    +1186     
============================================
+ Hits           4390     5314     +924     
- Misses          196      458     +262     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.