Add AuthorizationComponent::skipAuthorizationActions()

[dereuromark]

Draft, mainly to have something concrete to discuss on #339.

The behavior asked for there mostly exists already: the skipAuthorization config key is handled in authorizeAction() and is documented in docs/en/component.md. Two things were missing.

A fluent setter, so a controller can declare its own public actions instead of centralizing them in AppController:

public function beforeFilter(EventInterface $event)
{
    parent::beforeFilter($event);

    $this->Authorization->skipAuthorizationActions('verifyEmail', 'webhook');
}

Signature and merge semantics mirror authorizeModel(string ...$actions).

Manual checks honoring the list. Previously only the automatic check in authorizeAction() looked at skipAuthorization, so a single gate in beforeFilter() still ran the policy for actions the application had already declared public:

$this->Authorization->skipAuthorizationActions('login', 'logout');

if (!$this->Authorization->can($this)) {
    return $this->redirect('/');
}

can(), canResult() and authorize() now treat the current action as authorized when it is on the list.

Two constraints on that, both covered by tests:

• Only an implicit check is affected. An explicit action still runs its policy, so can($article, 'delete') is unchanged by delete being on the list. Otherwise a list of public controller actions would silently turn into a list of always-allowed policy verbs, which is not what the config means and would be easy to trip over in a template.
• The raw action name is matched, through a shared isSkippedAction() helper, so authorizeAction() and the manual checks agree when actionMap is set. Matching the mapped name in one path and the raw name in the other would make mapAction('edit', 'modify') skip in one place and not the other.

canResult() returns a Result, not true, since it is typed : ResultInterface and authorize() calls getStatus() on what it returns.

Docs now describe the three ways to skip and when each fits, per LordSimal's request on the issue.

Open question before this leaves draft: the name. skipAuthorizationActions() matches the config key but is long. Alternatives raised on the issue are allowUnauthorized(), authorizeAction() and authorizeController(). Worth noting #172 and #176 went the other way, collapsing authorizeModel() and mapAction() into a single action config, so a third fluent setter may be the wrong shape regardless of the name.

Refs #339