Breaking Change: Authentication: AutomaticAuthentication has been split

[HaoK]

We decided to split the AutomaticAuthentication flag into two new flags to allow controlling the behavior in a more granular way:

AutomaticAuthenticate: determines whether the authentication scheme will call Authenticate and merge any claims principals produced into HttpContext.User

AutomaticChallenge: determines whether the authentication scheme will handle any naked Challenges, i.e. [Authorize], or any explicit challenge calls where the scheme wasn't specified context.Authentication.Challenge()

cc @blowdart @Tratcher

[HaoK]

To restore similar behavior today:

For cookies, set both AutomaticAuthenticate and AutomaticChallenge to true to mimic the old AutomaticAuthentication: true

For Social Auth, only AutomaticChallenge has any effect since they do not produce principals anyways.