VaadinWebSecurity was deprecated in 24.9.
According to the docs one should use VaadinSecurityConfigurer instead.
Problem: VaadinSecurityConfigurer is final so you can't extend it and it also has a private constructor so you can't instantiate it -.-
Upstream: vaadin/flow#22293
Probable solution: "rebase" our code onto VaadinSecurityConfigurer or - if they refuse to make it accessible - copy the code / use the reflection crowbar.