CVE-2023-27481: Directus vulnerable to extraction of password hashes through export querying

The vulnerability stems from two key points: 1) Filter processing logic allowing string operators on hashed fields, and 2) GraphQL type definitions not properly restricting operators for concealed fields. The patches in PR#14829 and PR#15010 explicitly address these by introducing operator allow-list checks and specialized GraphQLHash types. While exact function names aren't visible in diffs, the pattern matches Directus' architecture where items service handles filtering and GraphQL types define field capabilities. The combination of these two components being improperly configured would directly enable the described hash extraction attack.