Spring Security Headers servlet-api 6.1.0 Integration

[rwinch]

In 6.1 the HttpServletResponse.setHeader method Javadoc was updated to state:

Passing null as the value removes all headers with the given name.

This means that we should be able to eagerly set all headers and if a single cache header is provided by the user, we can first clear the cache control headers set by security.

We should also be able to deprecate the OnCommitedResponseWrapper

We should provide this as an opt in feature.

In order to support this we will need to update HeaderWriter to be able to return a new request/response so that the cache writer can track the cache headers as a group and override them. Something like:

default ServletExchange writeHeaders(HttpServletRequest request, HttpServletResponse response) {
   writeHeaders(request, response);
   return new ServletExchange(wrap(request), wrap(response));
}