WebSessionServerOAuth2AuthorizedClientRepository should not store entire ClientRegistration in every session

Expected Behavior

The implementation does not store ClientRegistration in WebSession but uses ReactiveClientRegistrationRepository to resolve from stored registrationId.

Current Behavior

The current implementation of WebSessionServerOAuth2AuthorizedClientRepository stores the entire OAuth2AuthorizedClient object in the WebSession. This does include ClientRegistration including clientId and clientSecret.

Using the default ServerOAuth2AuthorizedClientRepository implementation (i.e. AuthenticatedPrincipalServerOAuth2AuthorizedClientRepository) relies on a ReactiveOAuth2AuthorizedClientService implementation which might be InMemoryReactiveOAuth2AuthorizedClientService depending on config. This does not seem viable for use with spring-session.

Context

Using it with spring-session will serialize the registration data for every user (again, including clientId and clientSecret). This does have performance and potential security implications. A simple fix would be storing and resolving an intermediary object like this:

	private <T extends OAuth2AuthorizedClient> Mono<T> toAuthorizedClient(final StoredOAuth2AuthorizedClient stored) {
		if (stored == null) {
			return Mono.empty();
		} else {
			// TODO handle unknown registrationId?
			return (Mono<T>) _clientRegistrationRepository.findByRegistrationId(stored.getRegistrationId())
					.map(stored::toOAuth2AuthorizedClient);
		}
	}

	@Data
	private static class StoredOAuth2AuthorizedClient implements Serializable {

		private String _registrationId;
		private String _principalName;
		private OAuth2AccessToken _accessToken;
		private OAuth2RefreshToken _refreshToken;

		public StoredOAuth2AuthorizedClient(@NonNull final OAuth2AuthorizedClient client) {
			_registrationId = client.getClientRegistration().getRegistrationId();
			_principalName = client.getPrincipalName();
			_accessToken = client.getAccessToken();
			_refreshToken = client.getRefreshToken();
		}

		public OAuth2AuthorizedClient toOAuth2AuthorizedClient(@NonNull final ClientRegistration clientRegistration) {
			return new OAuth2AuthorizedClient(clientRegistration, _principalName, _accessToken, _refreshToken);
		}

	}

Start with WebSessionServerOAuth2AuthorizedClientRepository and trace its use of ReactiveClientRegistrationRepository and WebSession. Compare the stored session data with the expected registrationId, access-token, and refresh-token behavior described in the issue. Done means sessions no longer serialize ClientRegistration or client credentials while authorized clients can still be reconstructed.