Support ServerWebExchangeFirewall @Bean

[rwinch]

Spring Security does not use the ServerWebExchangeFirewall Bean when exposed.

We should fix this, but in the meantime users can leverage a BeanPostProcessor approach.

@Bean
BeanPostProcessor beanPostProcessor() {
	return new BeanPostProcessor() {
		@Override
		public Object postProcessBeforeInitialization(Object bean, String beanName) throws BeansException {
			if (bean instanceof WebFilterChainProxy) {
				WebFilterChainProxy springSecurity = (WebFilterChainProxy) bean;
				springSecurity.setFirewall(ServerWebExchangeFirewall.INSECURE_NOOP);
			}
			return bean;
		}
	};
}

Related #15989 #15975

[alfein]

Unfortunately, if the spring boot project runs on cloud foundry, the ReactiveCloudFoundryActuatorAutoConfiguration will activate and will cause the StrictWebExchangeFirewall to be reset to more strict mode again.

This disables the above

management:
  cloudfoundry:
    enabled: false