Support [AllowAnonymous] along with [Authorize]

[Shane32]

This allows bypassing parent type's authorization while defining new requirements on the field. Previously any requirements on the field were ignored.

Sample:

# .AuthorizeWithRoles("Admin")
type Mutation {
  createUser(name: String!): String # requires Admin role

  # .AllowAnonymous()
  # .Authorize()
  updateOwnProfile(email: String!): Boolean # requires any authenticated user

  # .AllowAnonymous()
  submitFeedback(message: String!): Boolean # anonymous user
}

Recently I found that I had assumed that .AllowAnonymous() would stack with .Authorize(), but this was not the case. So, is this a security bug fix, or a new feature? Not sure, but I don't think it warrants a major version bump. All prior tests pass.