RequestedUrlRedirectInvalidSessionStrategy can cause the HTTP method to change depending on the user agent

[mches]

Describe the bug
RequestedUrlRedirectInvalidSessionStrategy#onInvalidSessionDetected(…) uses DefaultRedirectStrategy#sendRedirect(…), which delegates to HttpServletResponse#sendRedirect(…) which always sets HTTP status 302 Found regardless of the HTTP method of the original request. I've observed this can cause the HTTP method to change from POST to GET depending on the user agent, as described in MDN documentation. The same documentation recommends to redirect with HTTP status 307 Temporary Redirect for HTTP methods other than GET and HEAD to prevent the user agent from changing the method.

Even if the specification requires the method (and the body) not to be altered when the redirection is performed, not all user-agents conform here - you can still find this type of bugged software out there. It is therefore recommended to set the 302 code only as a response for GET or HEAD methods and to use 307 Temporary Redirect instead, as the method change is explicitly prohibited in that case.

To Reproduce
Set an instance of RequestedUrlRedirectInvalidSessionStrategy as the invalid session strategy in the security filter chain. Make a POST request with an invalid session ID with Chrome browser. Observe a method not supported error due to Chrome using the GET method where only POST is allowed.

Expected behavior
The POST request with an invalid session ID should be redirected with HTTP status 307 Temporary Redirect. Chrome will be prohibited from changing the HTTP method.

Sample

5.7.x...mches:spring-security:gh-12797