Make AuthorizeFilter work in endpoint routing

[pranavkm]

Fixes #8387

[pranavkm]

I'll work on adding more tests \ but this would be a start

[rynowak]

This looks a lot like what I expected!

There are a few really ugly things here, but that's not really something we can avoid.

[HaoK]

Historically the place we see the most bugs is when there's a action that is trying to mix cookies and bearer, if its not too hard, do you think you can add one or two tests for that scenario here?

Basically something like:

[Authorize] // requires any authenticated user (aka the application cookie typically)
public class Controller {
   [Authorize(AuthenticationScheme = "Bearer")]
   public void Api();

   public void Cookie();

   [AllowAnonymous]
   public void PartyOn();

And ideally there would be a few tests that calls these actions at least twice in a few different orders (i.e. anon, bearer, cookie vs cookie, anon, bearer, etc) to make sure that we catch something like #7687

[pranavkm]