Restrict protected meta-key writes and option reads to administrators

[leoloso]

Security

Updates the GatoGraphQL submodule with the fixes for:

• Privilege escalation via the user meta mutations — protected user meta keys (role/capabilities, user_level, session_tokens, application passwords) can no longer be written by non-administrators through the meta mutations or the createUser/updateUser meta input.
• Protected meta on other entities — the custom post, comment and taxonomy meta mutations now reject WordPress protected meta keys for non-administrators.
• Arbitrary option disclosure — reading site options is now restricted to administrators unless the option is in the settings allowlist (default empty).

See the GatoGraphQL submodule PR for details.