Replace `WebSecurityConfigurer` and `WebSecurityConfigurerAdapter`
configurations with `WebSecurityCustomizer` or `SecurityFilterChain`
beans.

Closes gh-23421

Update `ConfigurationProperty` with a sensible `toString()` to help
debug task failures.

Closes gh-23771

See gh-23914

Close gh-23913

Closes gh-23876

Closes gh-23915

Closes gh-23911

Closes gh-23910

Previously, @WebListeners were discovered via custom component scanning
and then registered programmatically via the ServletContext. The servlet
spec requires any ServletContextListener registered in this manner to be
prohibited from programatically configuring servlets, filters, and
listeners. This left us not strictly complying with the servlet spec
as a ServletContextListener registered via a @WebListener annotation
should be able to programatically configure other components.

This commit updates WebListenerHandler to register each @WebListener
component directly with Jetty, Tomcat, or Undertow rather than via the
ServletContext API. This ensure that any @WebListener-annoated
ServletContextListener registered via servlet component scanning is
able to programatically register servlets, filters, and listeners.

There is a small chance that this will be a breaking change for some
users:

1. The ServletListenerRegistrationBeans that were previously defined
   for each @WebListener will now be
   WebListenerHandler.WebListenerRegistrars
2. Each @WebListener-annotated class will now be instantiated by
   Jetty, Tomcat, or Undertow. Jetty and Tomcat both require the class
   to be public and have a public default constructor. Previously,
   a package-private class or default constructor could be used as the
   instantiation was performed by Spring Framework. Undertow is not
   affected as it can instantiate a package-private type.

Fixes gh-18303

When `EnvironmentEndpoint` is building a response to return to the
web infrastructure, it creates a data structure containing all
property values from all property sources. Prior to this commit, it
was possible for the response data structure to contain property
values that were not serializable to JSON by Jackson, which would
cause an exception to be thrown by the web infrastructure. This
commit ensures the data structure is serializable to JSON by
ensuring property values are primitives or Strings, and returning
a placeholder value if a property value is of any other type.

Fixes gh-23805

Closes gh-23770

Closes gh-23769

Closes gh-23792

Fixed gh-23827

Closes gh-23908

Closes gh-23705

Previously, the test would make an HTTP request and, as soon as the
response was received, it would check the presence and value of the
http.server.requests meter. This create a race condition between the
meter being registered once the response had been flushed and the
meter's presence being checked. If the check won the race, the test
would fail.

This commit updates the test to wait for up to 5 seconds for the
meter to be present and have a count of 1, matching the single request
that has been made.

Fixes gh-23863

Previously, the base path of a servlet-based management server could be
configured using management.server.servlet.context-path but there was no
equivalent property for WebFlux.

This commit introduces a new property, management.server.base-path,
that can be used with both servlet and reactive management servers. The
existing servlet-specific property has been deprecated in favour of the
new general property. When using the servlet stack, if both the general
property and the servlet-specific property are set, the new general
property takes precedence. When using the reactive stack, only the new
general property is considered.

Closes gh-22906

Closes gh-23906

Closes gh-23905

Closes gh-23904

Closes gh-23903

Closes gh-23902

Closes gh-23901

Closes gh-23900

Closes gh-23899

Closes gh-23898

Closes gh-23897

Closes gh-23896

Closes gh-23895

Closes gh-23894

Closes gh-23893

Closes gh-23892