Globally accessible hooks into the session / auth lifecycle.

This supports IPlugin authors, allowing session lifecycle hooks to be
registered without needing changes to the IAuthSession
WebSudo feature, allowing requests to be tagged with [WebSudoRequired]

This feature forces a fresh login to be performed by the user for any
action marked with [WebSudoRequired]. Only subsequent logins will grant
the elevated access for the configured duration (default 20 minutes).

Example Configuration:
var authFeature = new AuthFeature(
    () => new WebSudoAuthUserSession(),
    new IAuthProvider[] { new CredentialsAuthProvider(new AppSettings()),})
    {
        RegisterPlugins = { new WebSudoFeature() }
    };
this.AddPlugin(authFeature);
Align field ordering to flow from base class
Merge pull request #936 from tvjames-Forks/auth-session-extension-points

Auth session extension points and a WebSudo feature