Prevent AllowAnonymous from overriding method-level authorization

[jscarle]

Summary

• track whether boolean metadata originates from class or method attributes so that method-level declarations can override inherited values
• ensure a method-level [RequireAuthorization] suppresses class-level [AllowAnonymous] unless the method explicitly opts in to anonymous access
• add a regression test that verifies .AllowAnonymous() is not emitted for a class [AllowAnonymous]/method [RequireAuthorization] combination

Testing

• dotnet test

---

Codex Task