I need a checklist for securing API endpoints against injection attacks in GraphQL schemas because our current REST migration stalled and our attack surface is wider than expected.