feat: allow anonymous access to endpoints or controller

[tmeckel]

Must support

[Authorize(Policy = "EmployeeOnly")]
public class VacationController : Controller
{
    public IActionResult Index()
    {
        return View();
    }

    [AllowAnonymous]
    public ActionResult VacationPolicy()
    {
        return View();
    }
}

[AllowAnonymous]
public class VacationPolicyController : Controller
{
    public ActionResult Policy()
    {
        return View();
    }
}

Use vendor extension x-aspnetcore-anonymous