Provide a request matcher for securing the H2 console

[philwebb]

See #10264 for background.

[snicoll]

Perhaps we could rename StaticResourceRequest to something a bit more general and have a h2Console option that uses spring.h2.console.path? The implementation should be straightforward considering what we have done for the actuator.

I guess finding a good name would be the most complicated part: that class already sits in the autoconfigure module where we are likely to provide support for "more stuff", so it doesn't strike me as crazy to try to generalize that a bit more.

[philwebb]

Yeah, I think that's not a bad idea. I don't think a H2ResourceReqest makes any sense. The name is indeed going to be the hard part.

[philwebb]

Perhaps something super general like PathRequest.

[mbhave]

I think if we really want to provide an easy way to add back 1.5 like security for H2, we would need something more than the RequestMatcher. The RequestMatcher only prevents duplication of spring.h2.console.path in the custom WebSecurityConfigurerAdapter but default 1.5 security for H2 was much more involved. I wonder if we can provide a SecurityConfigurer instead.

[philwebb]

I didn't realize it did that much!

I wonder if we can provide a SecurityConfigurer instead

I guess it depends how easy it is to mix that in with existing security concerns. One reason I like the new matchers is it's easy to plug them in at the correct place (not bean ordering etc). In the past Rob talked about using some static helper, perhaps this would be a good candidate for that?

[mbhave]

We're going to go with a RequestMatcher