Authentication should be done before OData validations

Assemblies affected
ASP.NET Core OData 8.x

Describe the bug
When calling a secured OData endpoint with wrong authentication, I get a 500 error instead of a 401.
This occurs when using an invalid key in the URL. Example odata/books/aaaaaaa or odata/books/1' when the expected key is an int.

Reproduce steps
I build a new web api project, added OData and basic authentication for testing purposes. View my example here https://github.com/berubejp/odatawebapptest

My issue occurs when I call the endpoint without or with wrong authentication.
When calling odata/books, I get a 401 response as expected.
When calling odata/books/1, I get a 401 response as expected.
When calling odata/books/1', I get a 500 response. Notice the single quote at the end or the URL.
When calling odata/books/aaaaaaa, I get a 500 response.

The error is ODataException: The key value (xx) from request is not valid.
This exception is triggered before the authentication is handled.

Request/Response
Using my example web api, you can call the web api using basic authentication using "admin:admin". However, the issue is triggered if authentication is invalid or absent.

Expected behavior
I would expected the authentication to kick and fail before any OData validations resulting in a 401 response.
The OData validation error should only be triggered if the authentication succeed.

Reproduce the behavior in the linked web API example with ASP.NET Core OData 8.x, comparing requests to odata/books, odata/books/1, and malformed keys such as odata/books/1' or odata/books/aaaaaaa. Trace where authentication and OData key validation are handled. Done means unauthenticated requests consistently return 401 before OData validation, while authenticated malformed requests still produce the validation error.