[5.8] Allow for explicit text parameters on Authorize middleware

[emiliopedrollo]

Pull Request #25763 broke some non documented functionality (explained here #26422) related to the Authorize middleware.

The previous implementation would allow to set an Authorize for a Gate with an optional parameter. That could be useful when the 'can' middleware is attached directly into the controller method (instead of a route) and thus act on multiple routes that access such method.

The current (master) implementation sends a string with the value of the Authorize argument if it's not a route parameter. This is behave ambiguous as any argument on the middleware can mean either a parameter of the request named after it or it's own name depending of the conditions a layer of abstraction up.

This PR solves this issue while still allowing the Authorize middleware to send string values to Gates by explicitly defining them as string using single or double quoted values on it's arguments, thus removing the ambiguity:

    // this should only send and route parameter to the gate or null if not available
    Route::middleware('can:ability,model');

    // This will send a string to the gate
    Route::middleware('can:ability,"some text"');

TL;DR; This reverts the default bahaviour to prior PR #25763, while still allowing string parameters.

[JackPriceBurns]

Just for clarity, what policy method now gets called when you use a string argument?

For example when you do $user->can('create', 'article')

Does it go to the authorised users' policy and check if there is a method called 'create' and call it with the current user and "article"

Or does it try and resolve 'article' to a model and then find that models policy, and then finds the create method and calls it with the authorised user and 'article'?

[emiliopedrollo]

@JackPriceBurns This does not change at all.

If you have registered a policy with the key 'article' it would return false as it cannot find the appropriate gate. With is exactly the current behaviour.

If you have registered let's say an ArticlePolicy to the key 'article' even when you have a Article model then it would call ArticlePolicy->create($user).

Neither way it would pass through the modified code.