Only call AddDataProtection in Authentication Services that require it

In .NET 8, we have a goal to enable JWT authentication with Native AOT. See `Stage 2.a` in https://github.com/dotnet/aspnetcore/issues/45910.

In order to use JWT authentication, the app needs to call `builder.Services.AddAuthentication()`. When bringing in `AddAuthentication()`, we are getting trimming / NativeAOT warnings from `System.Security.Cryptography.Xml`. `System.Security.Cryptography.Xml` is not currently trimming / NativeAOT compatible. See https://github.com/dotnet/runtime/issues/73432. It also appears to be a major amount of work to make it compatible, possibly with many "gotchas".

The reason `System.Security.Cryptography.Xml` is brought into the app is because this line:

https://github.com/dotnet/aspnetcore/blob/9c38b3749a69050e0670b8750d9828cf47a19b41/src/Security/Authentication/Core/src/AuthenticationServiceCollectionExtensions.cs#L24

`DataProtection` brings in the dependency on `System.Security.Cryptography.Xml`.

However, to enable JWT bearer authentication, it doesn't require `DataProtection`. Other types of authentication services do, for example:

* [Cookies](https://github.com/dotnet/aspnetcore/blob/3265dc6a9b05c74b199aa39351e5413317df9ad5/src/Security/Authentication/Cookies/src/PostConfigureCookieAuthenticationOptions.cs#L43)
* [OpenIdConnect](https://github.com/dotnet/aspnetcore/blob/3265dc6a9b05c74b199aa39351e5413317df9ad5/src/Security/Authentication/OpenIdConnect/src/OpenIdConnectPostConfigureOptions.cs#L47-L58)
* [OAuth](https://github.com/dotnet/aspnetcore/blob/3265dc6a9b05c74b199aa39351e5413317df9ad5/src/Security/Authentication/OAuth/src/OAuthPostConfigureOptions.cs#L46-L48)
* [WsFederation](https://github.com/dotnet/aspnetcore/blob/3265dc6a9b05c74b199aa39351e5413317df9ad5/src/Security/Authentication/WsFederation/src/WsFederationPostConfigureOptions.cs#L38)
* [Twitter](https://github.com/dotnet/aspnetcore/blob/3265dc6a9b05c74b199aa39351e5413317df9ad5/src/Security/Authentication/Twitter/src/TwitterPostConfigureOptions.cs#L35)
* etc

So it made sense originally to add `DataProtection` in a common place, and if the app didn't use it - no big deal. But now with NativeAOT and trimming, it does affect the app because the unused code can't be trimmed from the app - making it bigger unnecessarily.

To solve both the size issue (being able to trim the unused DataProtection code) and the fact that `System.Security.Cryptography.Xml` is not compatible with NativeAOT/trimming, we should remove `AddDataProtection()` from `AddAuthentication()` and instead move the calls to all the specific authentication services that require it.

Note that this would be a breaking change because an app could just call `AddAuthentication()`, without calling one of the built-in auth services, and then try to get DataProtection services, it will fail (since they aren't registered).

### Alternatives

One alternative is to create a new `AddAuthenticationCore()` method that doesn't call `AddDataProtection()`, but does everything else `AddAuthentication()` does today.

cc @halter73 @davidfowl @JamesNK @DamianEdwards