Unhandled MessageSecurityException on example with UserNamePasswordValidationMode.Custom

**Which sample is the bug for**
[https://github.com/CoreWCF/samples/tree/main/Basic/Binding/WS/WsHttpUserPassword_server]

**Describe the bug**
When called by the WSHttpUserPassword_client project an unhandled exception occurs on the server and no faultexception is sent to the client.

**To Reproduce**
Steps to reproduce the behavior:
1. Start the WsHttpUserPassword_server project
2. Start the WSHttpUserPassword_client project
3. The following unhandled MessageSecurityException: Message security verification failed occurs on the server
4. Stack:
```
Hosting environment: Development
Content root path: C:\samples-main\Basic\Binding\WS\WsHttpUserPassword_server\bin\Debug\net6.0
Now listening on: http://localhost:8088
Now listening on: https://localhost:8443
Application started. Press Ctrl+C to shut down.
info: Microsoft.AspNetCore.Hosting.Diagnostics[1]
Request starting HTTP/1.1 POST https://localhost:8443/EchoService/wsHttpUserPassword application/soap+xml;+charset=utf-8 1615
fail: Microsoft.AspNetCore.Server.Kestrel[13]
Connection id "0HMNL6LA1NTDC", Request id "0HMNL6LA1NTDC:00000002": An unhandled exception was thrown by the application.
CoreWCF.Security.MessageSecurityException: Message security verification failed.
---> CoreWCF.FaultException: Unknown Username or Incorrect Password
at NetCoreServer.CustomUserNamePasswordValidator.ValidateAsync(String userName, String password) in C:\samples-main\Basic\Binding\WS\WsHttpUserPassword_server\CustomUserNamePasswordValidator.cs:line 14
at CoreWCF.IdentityModel.Selectors.CustomUserNameSecurityTokenAuthenticator.ValidateUserNamePasswordCoreAsync(String userName, String password)
at CoreWCF.IdentityModel.Selectors.SecurityTokenAuthenticator.ValidateTokenAsync(SecurityToken token)
at CoreWCF.Security.ReceiveSecurityHeader.ReadTokenAsync(XmlReader reader, SecurityTokenResolver tokenResolver, IList`1 allowedTokenAuthenticators)
at CoreWCF.Security.ReceiveSecurityHeader.ReadTokenAsync(XmlDictionaryReader reader, Int32 position, Byte[] decryptedBuffer, SecurityToken encryptionToken, String idInEncryptedForm, TimeSpan timeout)
at CoreWCF.Security.ReceiveSecurityHeader.ExecuteFullPassAsync(XmlDictionaryReader reader)
at CoreWCF.Security.ReceiveSecurityHeader.ProcessAsync(TimeSpan timeout, ChannelBinding channelBinding, ExtendedProtectionPolicy extendedProtectionPolicy)
at CoreWCF.Security.TransportSecurityProtocol.VerifyIncomingMessageCoreAsync(Message message, TimeSpan timeout) at CoreWCF.Security.TransportSecurityProtocol.VerifyIncomingMessageAsync(Message message, TimeSpan timeout)
--- End of inner exception stack trace ---
at CoreWCF.Security.TransportSecurityProtocol.VerifyIncomingMessageAsync(Message message, TimeSpan timeout)
at CoreWCF.Security.SecurityProtocol.VerifyIncomingMessageAsync(Message message, TimeSpan timeout, SecurityProtocolCorrelationState[] correlationStates)
at CoreWCF.Dispatcher.ServerSecurityChannelDispatcher`1.VerifyIncomingMessageAsync(Message message, TimeSpan timeout, SecurityProtocolCorrelationState[] correlationState)
at CoreWCF.Dispatcher.SecurityReplyChannelDispatcher.ProcessReceivedRequestAsync(RequestContext requestContext) at CoreWCF.Dispatcher.SecurityReplyChannelDispatcher.DispatchAsync(RequestContext context)
at CoreWCF.Channels.ReplyChannelDemuxer.ReplyChannelDispatcher.DispatchAsync(RequestContext context)
at CoreWCF.Channels.AspNetCoreReplyChannel.HandleRequestCore(HttpContext context)
at CoreWCF.Channels.AspNetCoreReplyChannel.HandleRequest(HttpContext context)
at CoreWCF.Channels.RequestDelegateHandler.HandleRequest(HttpContext context)
at CoreWCF.Channels.ServiceModelHttpMiddleware.InvokeAsync(HttpContext context)
at CoreWCF.Channels.MetadataMiddleware.InvokeAsync(HttpContext context)
at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ProcessRequests[TContext](IHttpApplication`1 application)
info: Microsoft.AspNetCore.Hosting.Diagnostics[2]
Request finished HTTP/1.1 POST https://localhost:8443/EchoService/wsHttpUserPassword application/soap+xml;+charset=utf-8 1615 - 500 0 - 8131.6224ms
```

**Expected behavior**
A faultexception is raised without the unhandled CoreWCF.Security.MessageSecurityException: Message security verification failed.

**Repo environment (please complete the following information):**
- OS: [Windows]
- Architecture [x64]
- .NET Version [e.g. 6.0]

**Additional context**
None

Beginnen Sie mit den Projekten WsHttpUserPassword_server und WSHttpUserPassword_client und untersuchen Sie dann CustomUserNamePasswordValidator.cs bei dem im Stacktrace angezeigten Validierungsfehler. Reproduzieren Sie die Anfrage mit den Beispielprojekten und überprüfen Sie, dass ein ungültiger Benutzername oder ein ungültiges Passwort für den Client eine Fault-Exception erzeugt, ohne dass auf dem Server eine unbehandelte CoreWCF.Security.MessageSecurityException auftritt.

Vom Indexierungsmodell aus dem Issue-Text verfasst.