Use GraphQL endpoint for sec training mutation

This change moves from a client-side mutation to a server-side mutation
for the security training mutation.

It also does a slight refactor due to a small GraphQL schema difference
between the client-side resolver and the backend.