fix(api): Don't prevent subscribing with API_KEY when there is also an owner-based rule

[mattcreaser]

• PR title and description conform to Pull Request guidelines.

Issue #, if available:
#2770

Description of changes:
This fix applies to models that have multiple types of authentication, e.g:

const schema = a.schema({
  Todo: a
    .model({
      content: a.string(),
    })
    .authorization(allow => [
        allow.publicApiKey().to(['read']),
        allow.owner()
    ]),
});

This schema translates into a model that has the following auth rules:

@ModelConfig(pluralName = "Todos", type = Model.Type.USER, version = 1, authRules = {
  @AuthRule(allow = AuthStrategy.PUBLIC, provider = "apiKey", operations = { ModelOperation.READ }),
  @AuthRule(allow = AuthStrategy.OWNER, ownerField = "owner", identityClaim = "cognito:username", provider = "userPools", operations = { ModelOperation.CREATE, ModelOperation.UPDATE, ModelOperation.DELETE, ModelOperation.READ })
}, hasLazySupport = true)
public final class Todo implements Model

We would previously disallow subscribing to this model using AuthorizationType.API_KEY, because of the presence of the AuthStrategy.OWNER rule. You should be able to subscribe using either type. If using AuthorizationType.API_KEY then you receive events for all models, while if using AuthorizationType.COGNITO_USER_POOLS you receive events only for your own models.

I also fixed a bug I noticed that could (rarely) prevent proper shutting down of the subscription when using MultiAuth subscriptions.

How did you test these changes?

• Verified that user can subscribe to a model with both public and owner read using API key, whether they are signed in or not, and receive all events for that model. The same user can also subscribe using cognito user pools (only when signed in) to receive only the events for models they create.

Documentation update required?

• No
• Yes (Please include a PR link for the documentation update)

General Checklist

• Added Unit Tests
• Added Integration Tests
• Security oriented best practices and standards are followed (e.g. using input sanitization, principle of least privilege, etc)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.