[3.x] Require non-empty permission claims in OWIN APIs

[Ignacio Inglese (iNinja)]

Summary

• Backport the final OWIN permission-claim validation behavior from Fix OWIN  #4006 and Require non-empty permission claims in OWIN APIs #4009 to the 3.x servicing branch.
• Require a recognized scope or role claim with a non-whitespace value by default.
• Preserve ACL-based authorization through AllowWebApiToBeAuthorizedByACL.
• Preserve existing consumer validation, request-token, and challenge callbacks.

Release notes

OWIN protected web APIs now reject bearer tokens that do not contain a recognized
scope or role claim with a non-whitespace value. Applications that perform their
own ACL-based authorization can continue to opt in with
AllowWebApiToBeAuthorizedByACL.

Testing

• 19 focused tests passed on .NET Framework 4.7.2.
• Microsoft.Identity.Web.OWIN built successfully.