6.5.0-M3 - passkeys csrf token handling not compatible with CookieCsrfTokenRepository

Describe the bug
we are using CookieCsrfTokenRepository with a SpaCsrfTokenRequestHandler as outlined in the docs: https://docs.spring.io/spring-security/reference/6.5/servlet/exploits/csrf.html#csrf-integration-javascript-spa

that means

• csrf tokens passed in the X-XSRF-TOKEN header are expected to be plain because they are retrieved from the corresponding cookie making them BREACH-safe
• csrf tokens passed in the _csrf request parameter are expected to be "xor-ed"/masked for BREACH-protection

the default passkey registration/authentication javascript uses the masked csrf token from the CsrfToken.class.getName() request attribute and sends it in the X-XSRF-TOKEN header.
that results in a 403 Forbidden.

To Reproduce

• see the sample app, especially SecurityConfig
• run the sample app
• go to http://localhost:8080/login and log in as user / ***
• go to http://localhost:8080/webauthn/register and try to register a passkey
• see 403 in browser console

Expected behavior
the default passkey registration/authentication javascript should check for the existence of a readable XSRF-TOKEN cookie (set by CookieCsrfTokenRepository) and if present, use that instead of the token retrieved from the CsrfToken.class.getName() request attribute.

Sample

sample app will be referenced asap.

Misc

current ugly workaround in SpaCsrfTokenRequestHandler: we check if the the token passed in the X-XSRF-TOKEN header represents a valid UUID,

• if yes - use CsrfTokenRequestAttributeHandler
• if no - use XorCsrfTokenRequestAttributeHandler

    /**
     * FIXME: remove UUID-check workaround when spring-security passkey default pages support {@link org.springframework.security.web.csrf.CookieCsrfTokenRepository}
     */
    @Override
    public String resolveCsrfTokenValue(HttpServletRequest request, CsrfToken csrfToken) {
        String headerValue = request.getHeader(csrfToken.getHeaderName());
        if (StringUtils.isNotBlank(headerValue)) {
            try {
                UUID.fromString(headerValue);
                return csrfTokenRequestAttributeHandler.resolveCsrfTokenValue(request, csrfToken);
            } catch (IllegalArgumentException e) {
                // noop
            }
        }
        return xorCsrfTokenRequestAttributeHandler.resolveCsrfTokenValue(request, csrfToken);
    }

Reproduce the failure in the sample app, starting with its SecurityConfig and the default passkey registration/authentication JavaScript. Trace how the X-XSRF-TOKEN header is populated from the CsrfToken request attribute, then verify behavior with a readable XSRF-TOKEN cookie from CookieCsrfTokenRepository. Done means registration and authentication no longer return 403 with that repository and existing CSRF behavior remains covered.