graphqlbackend: specify `NoNamespace` to exclude inaccessible external services

Created by: unknwon

Based on our product design, site admins are not able to access user code host connections, this design is correctly enforced when site admins try to access them individually. However, this can be currently bypassed using externalServices endpoint.

This PR fixes that.

Another nice side-effect is that in the site admin area, we now only see the site-level code host connections.