Allow unauthenticated antiforgery token to work for authenticated users

### Is your feature request related to a problem? Please describe.
My web api application allows two SPAs working with it. Where each SPA is using different authentication scheme (cookie, and basic in my case). I'm issuing anti-forgery token & cookie prior to authentication which works fine but when I'm trying to use applications after signing-in (with ClaimsPrincipal & ClaimsIdentity) I got issues since token verification failure (due to logic from ClaimUidExtractor). As of right now I had to fork entire AntiForgery implementation to allow un-authenticated anti-forgery token to work for signed-in individual and as well to work simulteniously for both of my SPAs.

### Describe the solution you'd like
a) Extend AntiforgeryOptions with a new property "public bool IssueAuthenticationFreeToken {get; set;} = false;"
b) Extend behavior of "AntiforgeryTokenGenerator.GenerateRequestToken()" and "AntiforgeryTokenGenerator.TryValidateTokenSet()" to respect the setting aboce

### Additional context
It should be quite a common case when the API application has to support a number of authentication schemes therefore having ability to use CSRF token&cookie uniformly across all the possible SPAs sounds reasonable.

Start by reading AntiforgeryOptions, AntiforgeryTokenGenerator.GenerateRequestToken(), AntiforgeryTokenGenerator.TryValidateTokenSet(), and the ClaimUidExtractor logic involved in token validation. Define how the proposed setting should preserve tokens issued before authentication across cookie and basic schemes, then verify the behavior with focused antiforgery tests.

Written by the indexing model from the issue text.