graphql: Fix 500 errors on invalid JSON

[mastercactapus]

Description:
Handles the case of invalid JSON in a request body to the /api/graphql endpoint.

• A 400 instead of 500 is returned
• The parse error is now returned (with body stripped)
• The common case of sending a non-object has a more clear error message (default would have been cant parse string into Go-type something something)

Which issue(s) this PR fixes:
Fixes #3498

Describe any introduced user-facing changes:
N/A

Describe any introduced API changes:
Invalid JSON will now result in a 400 bad request rather than 500 unexpected error

Additional Info:
Added a smoke test to validate the new behavior.