Closes gh-26645

* pr/26632:
  Remove workaround for SUREFIRE-1679

Closes gh-26632

See gh-26632

Closes gh-26622

Move resource handler auto-configuration logic back to the
`WebMvcConfigurer` so that they also get applied to child contexts.

Closes gh-25743

Fixes gh-24541

Closes gh-26611

Fixes gh-11987

This commit restores the order of additional and active profiles
so that active profiles now take precedence.

Fixes gh-26189

Closes gh-26607

Fixes gh-22689

Closes gh-26605

Fixes gh-26470

Closes gh-26602

Closes gh-26601

Closes gh-26600

Closes gh-26599

Closes gh-26598

Closes gh-26597

Closes gh-26391

Closes gh-26426

Closes gh-26595

Fixes gh-24151

Closes gh-26587

See gh-26587

Closes gh-26383

Closes gh-26385

Closes gh-26429

Update `ConfigData` so that it signal if is considered optional. This
update allows `ConfigDataLocationResolvers` to return results that
behave in the same way as `optional:` prefixed locations without the
user themselves needing to prefix the location string.

Closes gh-25894

* pr/25868:
  Polish 'Allow remote devtools access with Spring Security'
  Allow remote devtools access with Spring Security

Closes gh-25868

See gh-25868

Update `ManagementWebSecurityAutoConfiguration` so that the
`managementSecurityFilterChain` bean has an explicit order.

Prior to this commit, the `managementSecurityFilterChain` would override
the `securityFilterChain` in `RemoteDevtoolsSecurityConfiguration` which
would prevent the remote devtools endpoint from being accessed.

See gh-25868