[Feature Request] Provide an IAuthorizationFilter to filter accepted appRoles in web apis called by daemon apps

[jmprieur]

Is your feature request related to a problem? Please describe.
The current version of microsoft-identity-web provides the RolesRequiredHttpContextExtensions.ValidateAppRole(HttpContext, String[]) Method to verify that the user authenticated in the web API has any of the accepted scopes.

This method must be called in the API methods you are implementing in web apis called by daemaons. In some situations this is a repeating activity with repeating code.

Describe the solution you'd like
Improve the situation by providing an IAuthorizationFilter decorator for API classes and methods like this:

[Authorize]
[RequiredAppRoles("admin", "writer")
public class HomeController : Controller
{
  /// ...
  public async Task<IActionResult> Action()
  {
  }
}

It should also be possible to provide the roles in the configuration

{
 "AzureAd" {
   // more settings
   "AppRoles" : "admin writer"
  }
}

then, you can reference it in the attribute:

[Authorize]
[RequiredAppRoles(RequiredAppRolesConfigurationKey = "AppRoles")]
public class HomeController : Controller
{
  /// ...
  public async Task<IActionResult> Action()
  {
  }
}

Additional context
Similar to #849, but for app roles (ClaimConstants.Roles et ClaimConstants.Role)

Todo

• Understand if this is even necessary. Would the [Authorize(Roles="admin")] do the same? this is for roles of users, whereas here this is for daemon apps, but this might be the same underlying claims.

Depending on the outcome, if we want to do this:

• Understand if we can share code with the scopes filter (maybe a based class with one virtual method which would provide th claims to validate and the error message to display?
• Add the attribute and the filter.
• Update the wiki page: https://github.com/AzureAD/microsoft-identity-web/wiki/web-apis#web-apis-called-by-daemon-apps-using-client-credential-flow
• Update the daemon sample to use this new attribute
• Update the following sample from the web app incremental tutorial: https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/blob/8294c9d4504ec115b68552acc9e63c8d49c5d892/5-WebApp-AuthZ/5-1-Roles/Startup.cs#L63 to avoid hacking the roles in
• Update docs.ms web api scenario landing page to use this new attribute

[jennyf19]

Update to use Policies

[jmprieur]

Fixed: #1742