Modular HttpSecurityDSL kotlin config cannot disable CSRF protection

Describe the bug

I tried disabling CSRF through Kotlin's modular HttpSecurityDSL configuration, but it didn't work.

To Reproduce

Sending a simple POST request returned a "Forbidden" error.

@Configuration
@EnableWebSecurity
@EnableMethodSecurity(prePostEnabled = true)
class WebSecurityConfig {

    @Bean
    fun springSecurity(http: HttpSecurity): SecurityFilterChain {
        http.csrf { it.spa() }
        http {
            csrf {
                ignoringRequestMatchers("/login/**", "/captcha")
            }
            authorizeHttpRequests {
                authorize(anyRequest, authenticated)
            }
        }
        return http.build()
    }

    // @Profile("dev")
    @Bean
    fun disableCSRF(): HttpSecurityDsl.() -> Unit = {
        csrf {
            disable()
        }
    }
}

Expected behavior
With CSRF protection disabled, sending a POST request returned a 200 Successful Request response.

Start by reproducing the Kotlin HttpSecurityDSL configuration shown in the issue, focusing on the csrf { disable() } block and the resulting POST request. Trace how the HttpSecurityDsl bean is applied alongside the HttpSecurity configuration, then verify that CSRF is disabled and the request returns 200 rather than Forbidden.