Make CookieAuthenticationDefaults and FacebookDefaults fields static readonly

[Eilon]

Many of them are currently const, which seems wrong.

[kevinchalet]

The cookie middleware and the FB provider are not the only ones using constants: Google, JWT/Bearer, MSFT, OIDC, Twitter also all use constants.

I'm not saying constants are more appropriate, but they have at least one merit for the default schemes: you can use them with AuthorizeAttribute:

[Authorize(ActiveAuthenticationSchemes = CookieAuthenticationDefaults.AuthenticationScheme)]

[Eilon]

Is the attribute scenario a common one?

The problem with these consts is that they are logically not constant, so that bugs me 😄

[Eilon]

Ah, we can keep the schemes const for this scenario. We should change just about everything else, though.

[brentschmaltz]

@Eilon @PinpointTownes const => will not change over time, readonly => fixed for this instance. Is this the reason to change to readonly?

[HaoK]

8359038