Consider resolving IAuthenticationSchemeProvider from DI in Invoke in AuthenticationMiddleware

In short, accepting the IAuthenticationSchemeProvider as a ctor to the AuthenticationMiddleware forces it to be a singleton. I know the default is deigned that way and put in DI that way, but if someone wants to replace it (say with something that hits a DB) then it's difficult.

Start by locating AuthenticationMiddleware and comparing its constructor with the Invoke path. Determine how resolving IAuthenticationSchemeProvider during Invoke would permit non-singleton implementations, then verify the middleware and authentication tests cover the expected lifetime behavior.

Written by the indexing model from the issue text.