Make Redirect Status Code Configurable

[mches]

• Makes it possible to customize the redirect strategy of RequestedUrlRedirectInvalidSessionStrategy, so that the servlet context path can be taken into account if desired.
• Makes the HTTP status code used by DefaultRedirectStrategy configurable, so that 307 Temporary Redirect can be chosen if desired.

Closes gh-12795
Closes gh-12797

[jzheaux]

Thanks for the PR, @mches! And sorry for the delay; I think this PR got lost in the shuffle.

I've left some inline feedback and look forward to your updates.

[jzheaux]

Also, since this is a new feature, @mches, will you please change the branch to main and ensure that any new APIs have a @since 6.2 JavaDoc?

[mches]

Also, since this is a new feature, @mches, will you please change the branch to main and ensure that any new APIs have a @since 6.2 JavaDoc?

I was hoping for this to be usable with Spring Boot 2.7.x, but I get it.

[mches]

Thanks for the PR, @mches! And sorry for the delay; I think this PR got lost in the shuffle.

I've left some inline feedback and look forward to your updates.

Thank you for the review, @jzheaux. I've responded inline.

I've also rebased, force-pushed, retargeted the PR and updated the PR documentation.

[mches]

@jzheaux SecurityContextHolderAwareRequestWrapperTests, and perhaps other tests, don't clear the context after each/all tests, so it becomes necessary to counteract side effects that crop up when such tests are run together. Adding @BeforeEach here does the trick, but I'm open to other options.

SecurityContextHolderAwareRequestWrapperTests.java for reference:

…
package org.springframework.security.web.servletapi;
…
public class SecurityContextHolderAwareRequestWrapperTests {

	@BeforeEach
	public void tearDown() {
		SecurityContextHolder.clearContext();
	}
…
	@Test
	public void testGetRemoteUserStringWithAuthenticatedPrincipal() {
		…
		SecurityContextHolder.getContext().setAuthentication(auth);
		…
	}

}