Delivery API: Retain the Delivery API login redirect behavior in .NET 10 (closes #21000)

[kjac]

Prerequisites

• I have added steps to test this contribution in the description below

If there's an existing issue for this PR then this fixes #21000

Description

This PR re-introduces the Delivery API login redirect behavior in .NET 10, following this breaking change from MS.

Note that I have opted to make the same assumption as are made for the Management API (which are also outlined by the above-mentioned article from MS): Any XHR request should yield a status code, any non-XHR request should perform explicit redirect to the login (or access denied) page.

The current implementation sort of does this already for redirects for "access denied" resources, but it's based on UmbracoApiController, which was obsoleted a long time ago. This is likely not at all sufficient to obtain the expected behavior, as new API controllers likely won't be implementing UmbracoApiController.

Update: The current implementation (special handling for UmbracoApiController) has been re-introduced to ensure backwards compatibility with Umbraco 16. The above-mentioned explicit inclusion of all XHR implicitly still works, as this is the default behavior for XHR.

Testing this PR

It is a little cumbersome to test this PR. The article about protected content in the Delivery API describes how to set it all up.

The easiest way to test this PR is to configure Swagger UI for authentication against the Delivery API. This way you won't need an external client for testing, and you won't have to worry about CORS config and whatnot.

Reach out if you want to test with an external client - I have it all running locally.

[AndyButland]

I've gone through the documented process of setting up member authentication with the delivery API, and can confirm I now get the expected redirect to the login page instead of the 401 API response.

Once logged in as a member I can access the protected content via a request from the Swagger UI (and when not logged in, I can't).

Other than as discussed there are some failing tests indicating a breaking behavioural change that should be reinstated, this looks good to me. I'll save the approval for one last look when the tests are rectified.