urlMapping confuses Sidecar Security Matcher

[AB-xdev]

The following situation occurred:

1. A Vaadin project that has an urlMapping active (e.g. vaadin.urlMapping=/2025/*)
2. A static redirector is instealled at the Root that redirects to the corresponing Vaadin Root (/ -> /2025)
3. The root endpoint is a public stateless resource (no session)
4. The Vaadin app is secured with the new VaadinSecurityConfigurer (Vaadin 24.9+ VaadinWebSecurity deprecated #196)

This results in an incorrect match of the public stateless resource chain designed for / on /2025:

2025-10-06T07:15:31.001Z TRACE 11032 --- [mcat-handler-57] o.s.security.web.FilterChainProxy        : Trying to match request against DefaultSecurityFilterChain defined as 'configureStaticResources' in [class path resource [software/xdev/sse/web/sidecar/public_stateless/PublicStatelessWebSecurity.class]] matching [Or [... Mvc [pattern='/'], ..., Mvc [pattern='/robots.txt'], Mvc [pattern='/favicon.ico']]] and having filters [DisableEncodeUrl, WebAsyncManagerIntegration, SecurityContextHolder, HeaderWriter, Logout, RequestCacheAware, SecurityContextHolderAwareRequest, AnonymousAuthentication, SessionManagement, ExceptionTranslation, Authorization] (2/3)
2025-10-06T07:15:31.001Z DEBUG 11032 --- [mcat-handler-57] o.s.security.web.FilterChainProxy        : Securing GET /2025/

which in turn causes a authentication failure because no Session is available, which causes the system to fallback to anonymous auth.

This seems to be caused by PathPatternMatchableHandlerMapping#match where

ServletRequestPathUtils.getParsedRequestPath(request).pathWithinApplication()

reports /2025 as /.

[AB-xdev]

The problem was also already present in the old code of the project, however it was never noticed because the SecurityContext was correctly retrieved.

This is no longer happening now (old left, new right):

[AB-xdev]

So the underlying problem here is that http#securityMatcher uses an MvcMatcher. MvcMatcher respects the urlMapping while AntMatcher does not.

The solution here is to make it selectable what should be used. By default it should likely be AntMatcher.