Queries that can run without csrfPrevention headers
I have a node application that is deployed on AWS behind a Application Load Balancer (ALB).  I have configured health checks to send a GET request to the Apollo server and run an arbitrary query defined in the URL.  With `csrfPrevention` enabled, these checks will always fail because the requests will be sent without the specified [headers](https://www.apollographql.com/docs/apollo-server/security/cors#preventing-cross-site-request-forgery-csrf).

I have no control over which headers are sent by the ALB.

I see two possible enhancements that could allow me to solve this problem:

1. Allow interjection via a plugin hook *before* the request is rejected, to allow certain operations to be run without required headers.
2. Allow a list of query operations to be passed in the `CSRFPreventionOptions` which are always allowed without the required headers.