Allow a defaultAction property on additional authorizers

On the primary authorizer, you can set a default action of ALLOW or DENY in order to allow or deny graphql queries _by default_. This is not possible on the additional authorizer.

When using Apollo client, I have ran into a situation where because of limitations with apollo only allowing one auth type, I am am having to switch out a new `client` into the apollo provider based on whether the user is logged in or not. If they are not logged in, I am passing in a client that uses the API_KEY authorizer, and if they are logged in, I am creating a new `client` with a `AMAZON_COGNITO_USER_POOLS` auth type and passing that into the apollo provider. Based on this, the API_KEY auth type needs to be the primary auth type and the `AMAZON_COGNITO_USER_POOLS` needs to be the additional auth type.

This allows guest users to access the graphql queries by default, and being restricted when I use an auth directive for a particular cognito group, which is fine. _However_, now the logged in users using the `AMAZON_COGNITO_USER_POOLS` auth type are blocked from the graphql queries _by default_, unless I give each query an auth directive, due to the additional auth type not having the ability to specific a default action of 'ALLOW'

Start by comparing the primary authorizer's defaultAction behavior with the additional-authorizer configuration and auth directive behavior described in the issue. Done means an additional authorizer can configure an ALLOW or DENY default, with guest and Cognito-authenticated GraphQL queries following the intended defaults.

Written by the indexing model from the issue text.