`/actuator/jolokia/list` not secured when using `EndpointRequest.toAnyEndpoint()`

[copa2]

When configuring a custom role for the actuator endpoints with
.requestMatchers(EndpointRequest.toAnyEndpoint()).hasRole("ACTUATOR") this will not work for sub path calls to /actuator/jolokia. (e.g. /actuator/jolokia/list)

Internally it will not match the MvcPattern
Trying to match using Mvc [pattern='/actuator/jolokia/**']

Workaround:
Defined an additional antMatcher("/actuator/jolokia/**").

Version: Spring Boot 2.1.7.RELEASE with Web/Security/Actuator and added jolokia-core.

Relevant Code:
https://github.com/copa2/actuator-security-bug/blob/master/src/main/java/com/example/actuatordemo/ActuatordemoApplication.java#L18-L37

See example project: https://github.com/copa2/actuator-security-bug
Call with curl -v -u "user:password" http://localhost:8080/actuator/jolokia/list