Decouple password validation/lockout APIs from cookie management

Many methods on the SignInManager provide the lockout semantics for user credential validation, but they also contain the code to manage/issue cookies (signin, MFA, etc). It would be nice to break those up, as many workflows require those checks, but perhaps additional custom checks before issuing the main login cookie, or MFA cookie. One such example would be additional risk assessment logic at login time. We want to validate the credentials with the lockout checks, but prior to issuing the cookie we want additional custom logic to inform the UI workflow (another example would be forced password reset due to suspected breach). In my proposal the UI layer would be responsible for issuing the cookie, not the identity layer.

As of now, the UI layer calls a method on the SignInManager and you will get back a positive result that it's the right user/creds, but then it's too late for the UI to take over a workflow because the main login cookie has already been issued.