Revamping form-binding in minimal APIs and MVC

[captainsafia]

This is a meta issue to track follow-up items in the work to add complex form binding support with anti-forgery token validation enabled for MVC and minimal APIs.

• API review for RequestTokenValidationAttribute
• Add support for modify FormOptions via metadata
• Add support for modifying FormDataMapperOptions via metadata
• Add support for DisableRequestSizeLimits
• Perf analyzer for anti-forgery middleware checks in endpoint routing
• Anti-forgery threat model
• Add tests for expanded form-binding scenarios
  • Recursive values
  • Enum values
  • Attributes for modifying binding (Ignore, DataMember)

[Tratcher]

• Add support for modify FormOptions via metadata

See MVC's RequestFormLimitsAttribute. These limits need to be applied when AntiForgery reads the form.

[captainsafia]

Closing this for now as I think the test cover in this test file provide good coverage here.