Introduce Scoped Value-based SecurityContextHolderStrategy

[eager-zh]

Closes gh-19259.

The implementation of Scoped Value-based SecurityContextHolderStrategy, henceforth Strategy, is rather straightforward:

• a ScopedValue instance holds a reference to SecurityContext similar to that of ThreadLocal;

• SecurityContextHolder is changed to be able to be configured with new SecurityContextHolderStrategy;

• a newly introduced ScopedSecurityContextHolderFilter orchestrates the usage of new Strategy, invoking upstack/downstream Security Filters in a Filter Chain with the ScopedValue instance bound to SecurityContext for the current thread;

• SecurityContextConfigurer is changed to replace SecurityContextHolderFilter with ScopedSecurityContextHolderFilter if current, globally configured Strategy is Scoped Value-based one;

• it was unnecessary, IMHO, to alter XML-based configuration as custom Strategy can be set for a particular Filter Chain by security-context-holder-strategy-ref attribute of http XML element.

What is not that straightforward is the configuration of Java compiler to be able to access Java 25 features, ScopedValue class in this case. For that purpose, Java compiler option --release was replaced with --source and --target options in java-toolchain.gradle; it also turned out to be necessary to set JVM target to 17 for Kotlin test compilation in test-compile-target-jdk25.gradle. As a result of these changes, the project now builds, uses ScopedValue, and still can run under JVM 17.

It is impossible to replace Subject.doAs calls with its Java 18 replacement Subject.callAs due to the requirement of compatibility with Java 17, and the correspondent deprecation warnings are suppressed.