Add support for options in form-binding and anti-forgery

[captainsafia]

Closes #49844.

Contributes to #49543.

[Tratcher]

Remember how you made FormFeature.Form throw if the anti-forgery token was bad? Is there any way someone could make that run before routing and then have this code throw?

[captainsafia]

FormFeature.Form will only throw if it detects IAntiforgeryValidationFeature has been set on the HttpContext. This can happen if either:

• The anti-forgery middleware has ran and set it
• The user has manually set it themselves

For the first case, the anti-forgery middleware is endpoint aware so running it before routing has configured the endpoint will not set the feature.

The second case is the more likely avenue that the user might arrive at this scenario, wherein they've configured their own middleware that sets the IAntiforgeryValidationFeature or they're setting endpoints manually with their own middleware then calling into our own anti-forgery middleware.

Under those circumstances, I'm fine throwing an exception for people here.

[sebastienros]

This is regressing all benchmarks using endpoint routing. Plaintext regresses by 16% for instance.