DefaultOAuth2AuthorizationRequestResolver should be extensible

Expected Behavior

DefaultOAuth2AuthorizationRequestResolver should provide a way to customize authorizationRequestMatcher and provide a customizable way to extract the registrationId on custom scenarios where we may need to store registrationId on headers or cookies but also want to leverage the default implementation since current class is final we can't even extend it.

private Function<HttpServletRequest, String> registrationIdResolver;

public DefaultOAuth2AuthorizationRequestResolver(ClientRegistrationRepository clientRegistrationRepository, String authorizationRequestBaseUri) {
    this(clientRegistrationRepository, new AntPathRequestMatcher(authorizationRequestBaseUri + "/{" + REGISTRATION_ID_URI_VARIABLE_NAME + "}")));
}

public DefaultOAuth2AuthorizationRequestResolver(ClientRegistrationRepository clientRegistrationRepository, AntPathRequestMatcher authorizationRequestMatcher) {
    this.clientRegistrationRepository = clientRegistrationRepository;
    this.authorizationRequestMatcher = authorizationRequestMatcher;
    this.registrationIdResolver = request -> {
        return authorizationRequestMatcher.matcher(request)
                .getVariables()
                .get(REGISTRATION_ID_URI_VARIABLE_NAME);
    };
}

public void setRegistrationIdResolver(Function<HttpServletRequest, String> registrationIdResolver) {
    this.registrationIdResolver = registrationIdResolver;
}

private String resolveRegistrationId(HttpServletRequest request) {
    if (!this.authorizationRequestMatcher.matches(request)) {
        return null;
    }

    return this.registrationIdResolver.apply(request);
}

Current Behavior

Current behavior does not enable providing a custom matcher nor an alternative way to extract the registrationId value from the request.
With the suggested changes we can have it customizable by possibly: 1. matching with different URIs, 2. being able to extract registrationId from request cookies, headers, etc.

Context

Currently implementing multi-tenant login support and need to recover from request context which registrationId to use. From the way that DefaultOAuth2AuthorizationRequestResolver is implemented, I had to basically copy & paste its source code to add the desired behavior since it is final and no way is provided to add custom behavior to it.

Start with DefaultOAuth2AuthorizationRequestResolver and trace its constructors, authorizationRequestMatcher handling, and registrationId resolution. Review the surrounding Spring Security OAuth2 authorization-request tests, then define and verify an extensibility path that supports custom matching and registrationId extraction without requiring users to copy the class.