graphql-middleware should actually be a dependency

[thekumar]

Otherwise, runtime errors about unknown dependencies from graphql-shield are thrown.

• What kind of change does this PR introduce? (Bug fix, feature, docs update, ...)
  Bug fix.

• What is the current behavior? (You can also link to an open issue here)
  Compiles fine, but throws errors around unknown dependency for 'graphql-middleware' when running jest tests.

• What is the new behavior (if this is a feature change)?
  Compiles and runs fine during tests.

• Other information:
  For context, I'm following Option 3: using the base rate limiter function.

[glensc]

change seems valid. but I am not sure is adding a new dependency a breaking change, i.e need to release 4.x?