WebSecurity.ignoring().anyRequest() no longer works

Describe the bug

In Spring Security 6.3.x, we can use WebSecurityCustomizer to customize WebSecurity to ignore all security checks. This is not for production, but useful for local testing when some properties are set. A simplified version:

@Configuration(proxyBeanMethods = false)
public class ApplicationConfiguration {

    @Bean
    WebSecurityCustomizer ignoreAllCustomizer() {
        return web -> web.ignoring().anyRequest();
    }
}

However because of https://github.com/spring-projects/spring-security/issues/15220 and https://github.com/spring-projects/spring-security/issues/15982, ignore all requests doesn't work anymore. Below exception will be thrown:

Caused by: org.springframework.security.web.UnreachableFilterChainException: A filter chain that matches any request [DefaultSecurityFilterChain matching [any request] and having filters []] has already been configured, which means that this filter chain [DefaultSecurityFilterChain defined as 'managementSecurityFilterChain' in [class path resource [org/springframework/boot/actuate/autoconfigure/security/servlet/ManagementWebSecurityAutoConfiguration.class]] matching [any request] and having filters [DisableEncodeUrl, WebAsyncManagerIntegration, SecurityContextHolder, HeaderWriter, Cors, Csrf, Logout, UsernamePasswordAuthentication, DefaultResources, DefaultLoginPageGenerating, DefaultLogoutPageGenerating, BasicAuthentication, RequestCacheAware, SecurityContextHolderAwareRequest, AnonymousAuthentication, ExceptionTranslation, Authorization]] will never get invoked. Please use `HttpSecurity#securityMatcher` to ensure that there is only one filter chain configured for 'any request' and that the 'any request' filter chain is published last.

The cause of this issue is WebSecurityFilterChainValidator now validate WebSecurity ignoredRequests together with HttpSecurity filter chain together. It will throw the above exception in that case.

To Reproduce

Create a Configuration class like the one mentioned above.

Expected behavior

I think WebSecurity.ignoring().anyRequest() should still get supported. I understand this is not for the production, but it provides a way to skip all the customizations in HttpSecurity.

Start with WebSecurityFilterChainValidator and the WebSecurity.ignoring().anyRequest() path, then reproduce the issue using the ApplicationConfiguration and WebSecurityCustomizer example. Compare how ignored requests are validated with the HttpSecurity filter chain, and verify that the configuration no longer throws UnreachableFilterChainException while the expected ignore-all behavior remains supported.