Use SecurityContextHolderStrategy for defaults

[jzheaux]

This introduces support for a SecurityContextHolderStrategy bean when used with the minimal configuration:

http
    .authorizeHttpRequests((authorize) -> authorize.anyRequest().authenticated())
    .formLogin(Customizer.withDefaults())
    .httpBasic(Customizer.withDefaults())

as well as

http
    .authorizeRequests((authorize) -> authorize.anyRequest().authenticated())
    .formLogin(Customizer.withDefaults())
    .httpBasic(Customizer.withDefaults())

including the subsequent lookup of the SecurityContext using @AuthenticationPrincipal.

[rwinch]

I have a concern that the HttpSecurity and AuthenticationPrincipalArgumentResolver may have different SecurityContextHoderStrategy associated with them.

[jzheaux]

We'll leave the DSL support out for now. It would be rather unexpected to use a different SecurityContextHolderStrategy for each filter chain. That said, if this turns out to be needed, the argument resolver could possibly be updated to look at the request attribute to get the security context.