Implement proper authorization model

Nobody has claimed this yet.

# Description/Steps to reproduce

Authorization model for strong-soap doesn't support for example bearer tokens. I would like to see more flexible authorization model which enables checking of the authorization header (be it whatever) and if bearer token, then check the claims. This should be done so that request and response are passed to callback which could do the job. By doing it this way enables minimal processing (no xml parsing, dom to Javascript mapping, ...) when denying illegal requests. Also status codes should be mapped then based on the "instructions" from the callback (401 or 403).

I did the support by using proxies, but it's doing all the work for nothing (if illegal) and status code mapping is not what I'd expect. I can make it return 401 or 403 (by setting statusCode property) but it anyhow renders also SOAP Envelope with a fault (which I don't like).

# Link to reproduction sandbox

# Expected result

# Additional information

No files or tests are named. Start by tracing strong-soap's current authorization and proxy handling, then clarify how request and response callbacks should inspect authorization headers, claims, and denial status codes. Done should define the callback contract and whether unauthorized requests return 401 or 403 without rendering a SOAP fault.

Written by the indexing model from the issue text.