Future AuthZ improvements list

This issue will track all the various Authorization improvements we are looking at for 2.1.

Some initial thoughts:
----
From @davidfowl

We've had a bunch of feedback about our authz system with respect to flowing context from the authorize attribute to the authorization handler:

- https://github.com/aspnet/Security/issues/670
- https://github.com/aspnet/Mvc/issues/5607
- https://github.com/aspnet/Security/issues/917
- https://github.com/aspnet/Security/issues/1352

Today the Authorize attribute supports has enough metadata to describe the policy but it doesn't let you specify the resource (via IAuthorizeData). I think if we solve that, it might solve a bulk of the issues since people will be able to write custom attributes that flow the relevant context to the authorization handler.

Today that's only possible when doing imperative authz. I was thinking something like:

```
public interface IAuthorizeResource
{
object Resource { get; }
}
```

If the attribute implemented this, we would flow that as the resource to the handler. This way you implement permissions of whatever you please via resources.

----
From @rynowak

Look into providing overriding semantics in MVC, maybe a marker interface: `IAuthorizeMetadata`. Any attributes that implement that interface on the endpoint could be flowed. Then it’s up to developers to build whatever they want. (Also look into flowing single objects vs many objects + requirements VS resources)

We will also look into making it possible to specify requirements via Attributes similar to imperative AuthZ so you don't have to preconstruct policies for attributes.

Misc other improvements:
----
- Consider supporting OR logic for policies: https://github.com/aspnet/Security/issues/1356
- Consider enabling policies to be defined in configuration
- Make it easier to be able to display authZ failure reasons in an error page etc https://github.com/aspnet/Security/issues/1530
- Make it easier to pass parameters to policies, i.e. https://github.com/aspnet/Security/issues/1689