This PR improves the error message for a common antiforgery validation scenario where developers mistakenly place .UseAntiforgery() before .UseAuthentication() in their middleware pipeline.

Problem

The current error message "The provided antiforgery token was meant for a different claims-based user than the current user" is not helpful when the real issue is middleware ordering. This occurs when:

1. An antiforgery token is generated for an authenticated user
2. Later, the same token is validated but the current user is not authenticated (due to middleware ordering)
3. The generic "different user" error message provides no guidance on the likely cause

Solution

Added logic to detect this specific scenario and provide a more actionable error message:

"The provided antiforgery token was meant for an authenticated user, but the current user is not authenticated. Did you put UseAntiforgery() after UseAuthentication()?"

The detection works by checking if:

• Current user is not authenticated (GetAuthenticatedIdentity(httpContext.User) == null)
• The request token was meant for an authenticated user (requestToken.ClaimUid != null OR !string.IsNullOrEmpty(requestToken.Username))

Changes Made

• Added new resource string AntiforgeryToken_ClaimUidMismatch_UnauthenticatedUser with the improved message
• Enhanced validation logic in DefaultAntiforgeryTokenGenerator.TryValidateTokenSet() to detect the unauthenticated user scenario in both username mismatch and ClaimUid mismatch validation paths
• Added comprehensive tests to verify the new behavior works correctly while preserving existing functionality for authenticated users

Testing

• All existing tests continue to pass, ensuring no breaking changes
• New tests verify the improved error message is shown in the specific scenario
• Tests confirm that normal validation behavior is unchanged for authenticated users

This change makes it much easier for developers to diagnose and fix the common middleware ordering issue.

Fixes #63218.

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.