OAuth2: ServletOAuth2AuthorizedClientExchangeFilterFunction can fail to remove client if webclient receives retryable responses.

Describe the bug

In some configuration setups, adding a ServletOAuth2AuthorizedClientExchangeFilterFunction to a WebClient that can retry on authorization failures causes an IllegalArgumentException when trying to remove the authorized client in cases where the WebClient receives a response actionable by the authorization failure forwarder. The ClientRequest is not always populated with a HttpServletRequest attribute when the filter is added via the WebClientBuilder.filter() method instead of using the the filter's filter.oauth2Configuration() method.

The filter.filter() method does merge the required objects into the ClientRequest when making an authorized client, but then does not use that merged request when executing the handler within the filter. Without the merged attributes, its impossible for the AuthorizationFailureForwarder to clean up the client in case there is a 401/403 response from the original ClientRequest.

To Reproduce

• Execute sample repository according to the readme.md

Expected behavior

It is expected that the authorizedClient is removed via the AuthorizationFailureForwarder in the case a webclient with a ServletOAuth2AuthorizedClientExchangeFilterFunction.

Sample

See Issue 17379 Sample

Start with ServletOAuth2AuthorizedClientExchangeFilterFunction, especially filter() and oauth2Configuration(), and compare how ClientRequest attributes are handled when the filter is added through WebClientBuilder.filter(). Reproduce the behavior using the linked Issue 17379 Sample and verify that a retryable 401/403 response lets AuthorizationFailureForwarder remove the authorized client without throwing IllegalArgumentException.