Add way to control the "strictness" of the API errors

Currently, we surface the same generic 403 error for authorization errors _and_ 404s. This is done to make sure we don't accidentally expose the schema and data within. However, it's also a pretty bad developer experience, as there's no real way to know whether or not you're running into a permissions problem, or just have a typo in your route.

We should consider adding an environment variable that lets you control how much security to "trade in" for DX, we could start with:

| level | description |
|------|------------|
| strict | Generic 403s for everything |
| normal | 403s, but with descriptions\* |
| ?? friendly | 404s for non-existing items, authorization errors w/ descriptions |

\* Descriptions like "You don't have permission to access the foo collection"

(h/t @MiniDigger)