Auto-configure a SecurityContextHolderStrategy bean

[heruan]

This is the first step towards #21401 and completes the migration from VaadinWebSecurity (now removed) to the recently introduced VaadinSecurityConfigurer in #21373.

It avoids the need to manually import VaadinAwareSecurityContextHolderStrategyConfiguration by removing the class and include the strategy bean definition in SpringSecurityAutoConfiguration with an additional SmartInitializingSingleton that sets the provided strategy bean statically in SecurityContextHolder.

Removing VaadinAwareSecurityContextHolderStrategyConfiguration is a minor breaking change since applications that currently import that configuration manually with

@Import(VaadinAwareSecurityContextHolderStrategyConfiguration.class)

must remove the explicit import. Runtime functionality is not affected since applications providing their own custom strategy bean will override the auto-configured bean and the custom strategy will be picked up by the SmartInitializingSingleton to be set statically.

Note: a deprecation cycle of VaadinAwareSecurityContextHolderStrategyConfiguration is not feasible since it's not allowed to keep two configurations providing the same conditional bean. An option could to deprecate and make it no-op to avoid compiler errors when importing the configuration (but this might just create some confusion).

[sonarqubecloud]

Quality Gate passed

Issues
14 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Test Results

1 287 files   -   4  1 287 suites   - 4   1h 12m 10s ⏱️ - 5m 51s
8 885 tests  - 125  8 818 ✅  - 125  65 💤  - 2  1 ❌ +1  1 🔥 +1 
9 282 runs   - 186  9 207 ✅  - 183  73 💤  - 5  1 ❌ +1  1 🔥 +1 

For more details on these failures and errors, see this check.

Results for commit ba32d9b. ± Comparison against base commit cb8e735.

This pull request removes 125 tests.

com.vaadin.flow.spring.flowsecuritycontextpath.AppViewIT ‑ access_restricted_to_admin
com.vaadin.flow.spring.flowsecuritycontextpath.AppViewIT ‑ access_restricted_to_all_by_default
com.vaadin.flow.spring.flowsecuritycontextpath.AppViewIT ‑ access_restricted_to_logged_in_users
com.vaadin.flow.spring.flowsecuritycontextpath.AppViewIT ‑ admin_impersonate_user_shows_expected
com.vaadin.flow.spring.flowsecuritycontextpath.AppViewIT ‑ client_menu_routes_correct_for_admin
com.vaadin.flow.spring.flowsecuritycontextpath.AppViewIT ‑ client_menu_routes_correct_for_anonymous
com.vaadin.flow.spring.flowsecuritycontextpath.AppViewIT ‑ client_menu_routes_correct_for_user
com.vaadin.flow.spring.flowsecuritycontextpath.AppViewIT ‑ logout_redirects_to_root_page
com.vaadin.flow.spring.flowsecuritycontextpath.AppViewIT ‑ logout_server_initiated_redirects_to_logout
com.vaadin.flow.spring.flowsecuritycontextpath.AppViewIT ‑ logout_via_doLogoutURL_redirects_to_logout
…