Fix CsrfConfigurer default AccessDeniedHandler consistency

[christophejan]

Fix when AccessDeniedHandler is specified per RequestMatcher on
ExceptionHandlingConfigurer.

This introduces evolutions on :

• CsrfConfigurer#getDefaultAccessDeniedHandler,
  to retrieve an AccessDeniedHandler similar to the one used by
  ExceptionHandlingConfigurer.
• OAuth2ResourceServerConfigurer#accessDeniedHandler, to continue to
  handle CsrfException with the default AccessDeniedHandler implementation

Fixes: gh-6511

I have submitted the CLA

[christophejan]

This pull request raise much more questions than I was expecting.

Before considering to merge this pull request, I think the following points should be reviewed :

1. First, regarding ExceptionHandlingConfigurer#defaultAccessDeniedHandlerFor visibility. Current visibility is public (and so usable in a WebSecurityConfigurerAdapter) but not well handled by CsrfConfigurer (cf CsrfConfigurer accessDeniedHandler logic #6511). On the other hand, with reactive applications, ServerHttpSecurity#defaultAccessDeniedHandlers is only used internally without any public method to interact with. Does servlet and reactive should be consistent ?
2. CsrfConfigurer default AccessDeniedHandler is currently retrieved from ExceptionHandlingConfigurer (when available). With reactive applications, there is no such interaction between CsrfSpec and ExceptionHandlingSpec. Does exception handling should be able to take responsibility for all AccessDeniedException or not ? Does servlet and reactive should be consistent ?
3. ExceptionHandlingConfigurer#createDefaultDeniedHandler(HttpSecurityBuilder) implementation feel wrong to me. Currently, if only a single default AccessDeniedHandler is specified, it will be what is used for the default AccessDeniedHandler so the associated RequestMatcher is ignored. When more entries are specified, all RequestMatcher are take in account and AccessDeniedHandlerImpl is used as default. From my point of view, it seems inconsistent ; either the default should be taken from the specified entries (like for entry points) or AccessDeniedHandlerImpl should be the default in any case.

I’m sorry to raise many points for a such simple issue.

Best regards

[rwinch]

Thanks for the PR This is merged via 4318a51