Spring Security HTTP headers not added for large files

I made a Spring Boot application using version 3.3.7. I have configured my endpoint to generate some HTTP headers, using some XML. like:

    <http request-matcher-ref="staticResourcesMatcher">
        <headers>
            <cache-control disabled="true"/>
            <content-security-policy policy-directives="default-src 'self' 'unsafe-eval' 'unsafe-inline'; img-src 'self' data:; connect-src *;"/>
            <cross-origin-embedder-policy policy="require-corp"/>
            <cross-origin-opener-policy policy="same-origin"/>
            <cross-origin-resource-policy policy="same-origin"/>
            <permissions-policy policy="geolocation=(), microphone=(), camera=()"/>
            <referrer-policy policy="no-referrer"/>
        </headers>
        <http-basic />
        <intercept-url pattern="**" access="isAuthenticated()" />
    </http>

When I access a particular resource, called /img/logo.png, the headers appear as expected:

However, when I access a different resource, called /img/error.png, the headers are missing:

When I debug, I can see that in both cases the ContentSecurityPolicyHeaderWriter class is called for all the required headers. However, in the case of the missing headers, the ResponseHttpFields instance is already committed before these headers are added, which means that they are never added.

I believe the issue is that for larger files, the response is starting to be written before the ContentSecurityPolicyHeaderWriter is being called

Start by reproducing the XML-configured headers with the /img/logo.png and /img/error.png resources in Spring Boot 3.3.7, then trace ContentSecurityPolicyHeaderWriter and ResponseHttpFields when the response becomes committed. Done means the configured security headers are present consistently, including for larger resources, with a regression test covering the differing response sizes.