+ routing: add `optionalAuthenticate` directive

- `optionalAuthenticate` directive provides `Some(userContext)` on
success, `None` if no credentials are provided, otherwise rejects
The `BasicAuth()` authenticator reports `CredentialsMissing` in this case which is correct for it (as there were no credentials in the `Basic` scheme) but this is arguably not the correct overall result for authorisation as credentials were provided in the `Authorization` header in the `bob` scheme; `CredentialsRejected` might be what you'd expect.

As such, I believe it might be more correct for this test to result in an `AuthenticationFailedRejection` rather than `None`, but that would be a much more significant change to the way authenticators work, so I've just based the test on the way they currently work.