Web API: make /graph accessible via the VPN (archive.internal.s.o), even without auth token

I've tried to access https://archive.internal.softwareheritage.org/api/1/graph/stats/ and I got Authentication credentials were not provided..

Would it be possible to lift the requirement of having an auth token (and an authorized user) for accessing /graph endpoints when coming from the VPN?

(Only team members have VPN access, so it should be safe to consider them trusted for this one.)

---

Migrated from T2728 (view on Phabricator)