Make AuthorizationMiddlewareResultHandler.HandleAsync virtual

## Background and Motivation

In the official documentation [example](
https://docs.microsoft.com/en-us/aspnet/core/security/authorization/customizingauthorizationmiddlewareresponse?view=aspnetcore-5.0) on how to handle special cases in AuthorizationMiddleware have this code to extended the default `IAuthorizationMiddlewareResultHandler` :

```c#
public class MyAuthorizationMiddlewareResultHandler : IAuthorizationMiddlewareResultHandler
{
private readonly AuthorizationMiddlewareResultHandler DefaultHandler = new AuthorizationMiddlewareResultHandler();

public async Task HandleAsync(
RequestDelegate requestDelegate,
HttpContext httpContext,
AuthorizationPolicy authorizationPolicy,
PolicyAuthorizationResult policyAuthorizationResult)
{
...
// Fallback to the default implementation.
await DefaultHandler.HandleAsync(requestDelegate, httpContext, authorizationPolicy,
policyAuthorizationResult);
}
}
```

## Proposed API

```C#
namespace Microsoft.AspNetCore.Authorization.Policy
{
public class AuthorizationMiddlewareResultHandler : IAuthorizationMiddlewareResultHandler
{
///
public virtual async Task HandleAsync(RequestDelegate next, HttpContext context, AuthorizationPolicy policy, PolicyAuthorizationResult authorizeResult)
{
...
}
}
}
```

## Usage Examples

``` C#
public class MyAuthorizationMiddlewareResultHandler : AuthorizationMiddlewareResultHandler
{
public override async Task HandleAsync(
RequestDelegate requestDelegate,
HttpContext httpContext,
AuthorizationPolicy authorizationPolicy,
PolicyAuthorizationResult policyAuthorizationResult)
{
...
// Fallback to the default implementation.
await base.HandleAsync(requestDelegate, httpContext, authorizationPolicy,
policyAuthorizationResult);
}
}
```

## Risks

I can't see any, maybe some performance regression if JIT can devirtualize the first scenario but not the second ?

Start by locating AuthorizationMiddlewareResultHandler and its HandleAsync implementation in the ASP.NET Core source. Compare it with the proposed API and the official customizing-authorization-middleware-response example. Done means the method supports overriding and the documented derived-handler usage can fall back through base.HandleAsync without changing the default behavior.

Written by the indexing model from the issue text.