Unhandled MessageSecurityException on example with UserNamePasswordValidationMode.Custom

**Which sample is the bug for**
[https://github.com/CoreWCF/samples/tree/main/Basic/Binding/WS/WsHttpUserPassword_server]

**Describe the bug**
When called by the WSHttpUserPassword_client project an unhandled exception occurs on the server and no faultexception is sent to the client.

**To Reproduce**
Steps to reproduce the behavior:
1. Start the WsHttpUserPassword_server project
2. Start the WSHttpUserPassword_client project
3. The following unhandled MessageSecurityException: Message security verification failed occurs on the server
4. Stack:
```
Hosting environment: Development
Content root path: C:\samples-main\Basic\Binding\WS\WsHttpUserPassword_server\bin\Debug\net6.0
Now listening on: http://localhost:8088
Now listening on: https://localhost:8443
Application started. Press Ctrl+C to shut down.
info: Microsoft.AspNetCore.Hosting.Diagnostics[1]
Request starting HTTP/1.1 POST https://localhost:8443/EchoService/wsHttpUserPassword application/soap+xml;+charset=utf-8 1615
fail: Microsoft.AspNetCore.Server.Kestrel[13]
Connection id "0HMNL6LA1NTDC", Request id "0HMNL6LA1NTDC:00000002": An unhandled exception was thrown by the application.
CoreWCF.Security.MessageSecurityException: Message security verification failed.
---> CoreWCF.FaultException: Unknown Username or Incorrect Password
at NetCoreServer.CustomUserNamePasswordValidator.ValidateAsync(String userName, String password) in C:\samples-main\Basic\Binding\WS\WsHttpUserPassword_server\CustomUserNamePasswordValidator.cs:line 14
at CoreWCF.IdentityModel.Selectors.CustomUserNameSecurityTokenAuthenticator.ValidateUserNamePasswordCoreAsync(String userName, String password)
at CoreWCF.IdentityModel.Selectors.SecurityTokenAuthenticator.ValidateTokenAsync(SecurityToken token)
at CoreWCF.Security.ReceiveSecurityHeader.ReadTokenAsync(XmlReader reader, SecurityTokenResolver tokenResolver, IList`1 allowedTokenAuthenticators)
at CoreWCF.Security.ReceiveSecurityHeader.ReadTokenAsync(XmlDictionaryReader reader, Int32 position, Byte[] decryptedBuffer, SecurityToken encryptionToken, String idInEncryptedForm, TimeSpan timeout)
at CoreWCF.Security.ReceiveSecurityHeader.ExecuteFullPassAsync(XmlDictionaryReader reader)
at CoreWCF.Security.ReceiveSecurityHeader.ProcessAsync(TimeSpan timeout, ChannelBinding channelBinding, ExtendedProtectionPolicy extendedProtectionPolicy)
at CoreWCF.Security.TransportSecurityProtocol.VerifyIncomingMessageCoreAsync(Message message, TimeSpan timeout) at CoreWCF.Security.TransportSecurityProtocol.VerifyIncomingMessageAsync(Message message, TimeSpan timeout)
--- End of inner exception stack trace ---
at CoreWCF.Security.TransportSecurityProtocol.VerifyIncomingMessageAsync(Message message, TimeSpan timeout)
at CoreWCF.Security.SecurityProtocol.VerifyIncomingMessageAsync(Message message, TimeSpan timeout, SecurityProtocolCorrelationState[] correlationStates)
at CoreWCF.Dispatcher.ServerSecurityChannelDispatcher`1.VerifyIncomingMessageAsync(Message message, TimeSpan timeout, SecurityProtocolCorrelationState[] correlationState)
at CoreWCF.Dispatcher.SecurityReplyChannelDispatcher.ProcessReceivedRequestAsync(RequestContext requestContext) at CoreWCF.Dispatcher.SecurityReplyChannelDispatcher.DispatchAsync(RequestContext context)
at CoreWCF.Channels.ReplyChannelDemuxer.ReplyChannelDispatcher.DispatchAsync(RequestContext context)
at CoreWCF.Channels.AspNetCoreReplyChannel.HandleRequestCore(HttpContext context)
at CoreWCF.Channels.AspNetCoreReplyChannel.HandleRequest(HttpContext context)
at CoreWCF.Channels.RequestDelegateHandler.HandleRequest(HttpContext context)
at CoreWCF.Channels.ServiceModelHttpMiddleware.InvokeAsync(HttpContext context)
at CoreWCF.Channels.MetadataMiddleware.InvokeAsync(HttpContext context)
at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ProcessRequests[TContext](IHttpApplication`1 application)
info: Microsoft.AspNetCore.Hosting.Diagnostics[2]
Request finished HTTP/1.1 POST https://localhost:8443/EchoService/wsHttpUserPassword application/soap+xml;+charset=utf-8 1615 - 500 0 - 8131.6224ms
```

**Expected behavior**
A faultexception is raised without the unhandled CoreWCF.Security.MessageSecurityException: Message security verification failed.

**Repo environment (please complete the following information):**
- OS: [Windows]
- Architecture [x64]
- .NET Version [e.g. 6.0]

**Additional context**
None

Iniziare con i progetti WsHttpUserPassword_server e WSHttpUserPassword_client, quindi esaminare CustomUserNamePasswordValidator.cs in corrispondenza dell’errore di convalida mostrato nello stack trace. Riprodurre la richiesta con i progetti di esempio e verificare che un nome utente o una password non validi producano un’eccezione di fault per il client senza una CoreWCF.Security.MessageSecurityException non gestita sul server.

Scritto dal modello di indicizzazione a partire dal testo della issue.