Release v22.31.2

Changed

• Arc checks the caller's identity before and after each authorization policy, including policy construction, for both Arc and ASP.NET policies. A policy that changes the identity now denies the request immediately, and later policies are no longer run against the changed identity, so a later policy cannot restore an earlier change unnoticed (#2830)
• The authorization documentation and decision 0006 state what the identity check covers: claims, authentication type, name and role claim types and the actor chain. They also state what it does not cover: hidden state in custom principal types, or a change undone within a single policy (#2830)