feat(pq): use 4xx status code on PQ errors

[glasser]

Previously, sending a request that failed for a PQ-related reason would return a 200 status code. Now, various PQ-related errors lead to non-200 status codes:

• Sending a PQ ID that is unknown yields 404 Not Found
• Sending freeform GraphQL when no freeform GraphQL is allowed yields 400 Bad Request
• Sending both a PQ ID and freeform GraphQL in the same request (if the APQ feature is not also enabled) yields 400 Bad Request
• Sending freeform GraphQL that is not in the safelist when the safelist is enabled yields 403 Forbidden
• A particular internal error that shouldn't happen yields 500 Internal Server Error

Checklist

Complete the checklist (and note appropriate exceptions) before the PR is marked ready-for-review.

• Changes are compatible¹
• Documentation² completed
• Performance impact assessed and acceptable
• Tests added and passing³
  • Unit Tests
  • Integration Tests
  • Manual Tests

Exceptions

This could be considered to be not backwards compatible; we are in the process of reaching out to the current users of this Enterprise-only feature before releasing it.

Notes

Footnotes

1. It may be appropriate to bring upcoming changes to the attention of other (impacted) groups. Please endeavour to do this before seeking PR approval. The mechanism for doing this will vary considerably, so use your judgement as to how and when to do this. ↩

2. Configuration is an important part of many changes. Where applicable please try to document configuration examples. ↩

3. Tick whichever testing boxes are applicable. If you are adding Manual Tests, please document the manual testing (extensively) in the Exceptions. ↩

[router-perf]

CI performance tests

• reload - Reload test over a long period of time at a constant rate of users
• events_big_cap_high_rate_callback - Stress test for events with a lot of users, deduplication enabled and high rate event with a big queue capacity using callback mode
• events_without_dedup_callback - Stress test for events with a lot of users and deduplication DISABLED using callback mode
• large-request - Stress test with a 1 MB request payload
• const - Basic stress test that runs with a constant number of users
• no-graphos - Basic stress test, no GraphOS.
• step-jemalloc-tuning - Clone of the basic stress test for jemalloc tuning
• events - Stress test for events with a lot of users and deduplication ENABLED
• events_callback - Stress test for events with a lot of users and deduplication ENABLED in callback mode
• events_big_cap_high_rate - Stress test for events with a lot of users, deduplication enabled and high rate event with a big queue capacity
• events_without_dedup - Stress test for events with a lot of users and deduplication DISABLED
• xxlarge-request - Stress test with 100 MB request payload
• xlarge-request - Stress test with 10 MB request payload
• step - Basic stress test that steps up the number of users over time

[glasser]

Changeset added. I'm classifying this as "fix" not "breaking", similar to #3122 and #2419.

[nicholascioli]

LGTM!