Consider updating AuthorizationMiddleware and CorsMiddleware to only set state in HttpContext if auth / cors metadata is present

Endpoint routing only checks for state in HttpContext if the route has Auth or CORs metadata:

https://github.com/dotnet/aspnetcore/blob/main/src/Http/Routing/src/EndpointMiddleware.cs#L38-L48

However, the middlewares update HttpContext.Items any time it sees an endpoint:

* https://github.com/dotnet/aspnetcore/blob/main/src/Security/Authorization/Policy/src/AuthorizationMiddleware.cs#L51-L58
* https://github.com/dotnet/aspnetcore/blob/main/src/Middleware/CORS/src/Infrastructure/CorsMiddleware.cs#L126-L133

We might benefit from slight improvements for endpoints with Auth or CORS metadata by updating these middlewares to only update context when they know EndpointMiddleware is going to observe it i.e.

```C#
if (endpoint?..GetMetadata() is not null)
{
// EndpointRoutingMiddleware uses this flag to check if the CORS middleware processed CORS metadata on the endpoint.
// The CORS middleware can only make this claim if it observes an actual endpoint.
context.Items[CorsMiddlewareWithEndpointInvokedKey] = CorsMiddlewareWithEndpointInvokedValue;
}
```