Adjust plugin order to correct interaction with telemetry & traffic shaping

[goto-bus-stop]

• Update the layer inventory document
  • This doesn't fully bring it up to date with the current state of 2.x, I think, but the plan for today will be to use this to audit the order of plugins and to document an understanding of the way requests flow through the router and the constraints on the placement of various layers.
• Move CSRF to the router service, and after traffic shaping
  • It being at the supergraph service was likely a leftover from the pre-router service era.
  • Moving this to the router service prevents doing unnecessary work like GraphQL parsing and validation if we're just going to reject the request anyways.
  • Previously, telemetry "worked" for CSRF-rejected requests because CSRF worked at the supergraph service. Now, CSRF happens at the router service, so it must be applied after telemetry in the plugin list.
• Move body size limit to after traffic shaping.

Follow-ups (Maybe for router 2.0.1 if necessary):

• Move CORS handling to a plugin so it can be done in-between telemetry and traffic shaping
• Disable Router span creation for CORS requests

[svc-apollo-docs]

✅ Docs preview has no changes

The preview was not built because there were no changes.

Build ID: d1282191da5adf43979ca34d

[github-actions]

@goto-bus-stop, please consider creating a changeset entry in /.changesets/. These instructions describe the process and tooling.

[bnjjj]

Should it be done before merging this PR ?

[goto-bus-stop]

No, 2.n or 3.0