Allow combining authorization policies in Authorize attribute same way how it works with roles.

`Authorize` attribute allows to specify multiple roles which work with OR-semantics. Unfortunately, there's only `Policy` property rather than `Policies`.

Policy defines requirements with AND-semantics. OR-semantics for single requirement can be implemented with multiple handlers. However, there's no option to easily combine policies in OR-mode.

For example, we want to check that user is Administrator, or resource belongs to the user. I see these checks as two distinct policies having various requirements:

```CSharp
[Authorize(Policies="UserIsAdministrator, UserOwnsTheOrder"]
[ApiController]
MyController : Controller {}
```

```CSharp
services.AddAuthorization(cfg => {
cfg.AddPolicy(
"UserOwnsTheOrder",
policy => policy.Requirements.Add(new UserOwnsTheOrderRequirement()));
cfg.AddPolicy(
"UserIsAdministrator",
policy => policy.RequireRole(UserAuthorizeRole.Operator));

});
services.AddTransient();
```