Compare composite argument values in sameValue (#108)

[jaideeppyne]

What

Fixes #108. OverlappingFieldsCanBeMerged fails to flag same-response-name fields whose object or list arguments differ, so genuinely conflicting queries pass validation:

{
  a: country(where: { code: "DE" })
  a: country(where: { code: "US" })   # should conflict, but is allowed to merge
}

Why

sameValue compares only Kind and Raw:

func sameValue(value1, value2 *ast.Value) bool {
    if value1.Kind != value2.Kind { return false }
    if value1.Raw != value2.Raw { return false }
    return true
}

But in the AST, object and list values keep their contents in Children and leave Raw empty (see ast/value.go). So every ObjectValue compares equal to every other ObjectValue, and likewise for lists. Per the GraphQL spec (§5.3.2, Field Selection Merging), fields sharing a response name must have identical arguments — a deep input-value comparison — or be aliased. Ignoring the children silently permits ambiguous queries to merge.

How

After the existing Kind/Raw checks, compare the children too:

• Input objects — field order is not significant (spec), so match children by name via the existing ChildValueList.ForName.
• Lists (and any other composite) — order is significant, so compare position by position.

Scalars are unaffected (they carry no children, so the loop is a no-op and the Raw check still decides).

Tests

Added Test_sameValue to overlapping_fields_can_be_merged_test.go, covering:

• identical/different scalars (baseline);
• objects with differing field values → not equal (fails without this change);
• identical objects, and objects with the same fields in a different order → equal;
• objects with a different field count → not equal;
• lists with differing elements → not equal (fails without this change);
• identical lists, and lists with the same elements reordered → not equal (order-sensitive).

go test ./... passes across the module, including the imported graphql-js spec suite (which covers allows different order of input object fields in arg values).

---

Disclosure: this change was prepared with AI assistance and reviewed/verified by me before submission.

[coveralls]

coverage: 87.525% (+0.04%) from 87.489% — jaideeppyne:fix/samevalue-composite-args into vektah:master