Improve authenticated check on output caching #68474

The #67110 added functionality to avoid caching responses for authenticated users. But it uses User?.Identity?.IsAuthenticated while DenyAnonymousAuthorizationRequirement uses an aggregate predicate over all identities in the principal. When an application produces a ClaimsPrincipal whose first identity is unauthenticated but a later identity is authenticated (an unusual application configuration that no default authentication handler or standard IClaimsTransformation pattern produces), authorization admits the request as authenticated while the cache policy classifies it as anonymous.

We should replace both primary-identity checks in DefaultPolicy with an aggregate check that matches authorization semantics, via a single shared helper so the request- and response-phase predicates cannot diverge again.

Someting like:

private static bool IsAuthenticated(HttpContext httpContext)
    => httpContext.User?.Identities.Any(static i => i.IsAuthenticated) == true;

Request phase (DefaultPolicy.cs:82): if (!StringValues.IsNullOrEmpty(request.Headers.Authorization) || IsAuthenticated(request.HttpContext)) { return false; }
Response phase (DefaultPolicy.cs:53): if (IsAuthenticated(context.HttpContext)) { context.AllowCacheStorage = false; return ValueTask.CompletedTask; }