AuthorizationAuditListener.onAuthorizationFailureEvent() should store accessed resource into event data

Hello, this is an enhancement request for actuator security audit.

Currently, when an access is denied for a REST endpoint, AuthorizationAuditListener publishes an AuditEvent with timestamp, principal, type and data map which stores a subset of the original event data: exception class, exception message, authentication details.

I think this data map should also contains the URI of the resource that was access denied which can be extracted from event.getSource().

        Object source = event.getSource();
        if (source instanceof FilterInvocation) {
            String requestUrl = ((FilterInvocation) source).getRequestUrl();
            data.put("url", requestUrl);
        }

While it is relatively easy to extend AuthorizationAuditListener to add this data, it seems to be a common use case that could be part of the default implementation.

Thanks

Start in spring-boot-project/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/security/AuthorizationAuditListener.java and inspect onAuthorizationFailureEvent(). Follow event.getSource() and FilterInvocation.getRequestUrl(); done means the published AuditEvent data includes the denied resource URI alongside the existing fields. The issue does not name a test, so locate the listener's existing coverage before changing behavior.