Provide a way to apply default AuthorizationPolicy even when Authorize attribute with Roles is specified

[marcominerva]

In ASP.NET Core, if we use something like [Authorize(Roles = ... )] (or equivalent), then the requirements that have been associated with the default authorization policy aren't enforced, for example:

services.AddAuthorization(options =>
{
    var policyBuilder = new AuthorizationPolicyBuilder().RequireAuthenticatedUser();
    policyBuilder.Requirements.Add(new ValidSessionRequirement());
    options.DefaultPolicy = policyBuilder.Build();
});

It is necessary to provide a way to guarantee that requirements of default policy are verified even when we're using Roles within the Authorize attribute.