Explicitely enable auth providers instead of disabling them

**Is your feature request related to a problem? Please describe.**
Currently, if you want to restrict which auth provider you want to use on your app you have to create `404` routes for every provider you want to disable: https://docs.microsoft.com/en-us/azure/static-web-apps/authentication-authorization?tabs=invitations#block-an-authorization-provider

To be honest, this feels more like a hack than a proper solution. It's very unsecure, not to mention painful to maintain! If more providers are added with new SWA releases, if you don't change anything in your app you may end up with problems and possible security holes. Point in case: I just discovered that other auth providers *NOT LISTED IN THE DOCS* can currently be used in deployed static web apps (for beta testing I suppose). How the hell am I supposed to guess that I have to disable them too?

**Describe the solution you'd like**
The industry standard and best practices for such feature is pretty simple: use an explicit allow list.
Something like this in the config file would solve this issue and simplify both setup and maintenance.

```json
"allowedAuthProviders": ["twitter", "github"]
```