@PostFilter throws an IllegalArgumentException on null return after migrating to @EnableMethodSecurity

Describe the bug
This might be either a bug, or a documentation gap.

On EnableGlobalMethodSecurity, PostFilter on a null return will return null from ExpressionBasedPostInvocationAdvice.

On EnableMethodSecurity, PostFilterAuthorizationMethodInterceptor calls DefaultMethodSecurityExpressionHandler.filter which throws an IllegalArgumentException.

To Reproduce

@Configuration
@EnableMethodSecurity
class SecurityConfig {
}

@Service
class MyService {
    @PostFilter("filterObject != null")
    public List<Object> someMethod() {
        return null;
    }
}

Call "someMethod()". It will throw an exception.

Switch to the legacy configuration:

@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
class SecurityConfig {
}

Call "someMethod()" again. It will return null.

Expected behavior

Either:

1. EnableMethodSecurity should preserve the legacy behavior from EnableGlobalMethodSecurity and return null when a PostFilter method returns null

or

2. The migration / PostFilter documentation should state that null return values aren't supported, and that this is different from the legacy EnableGlobalMethodSecurity.

Start with PostFilterAuthorizationMethodInterceptor and DefaultMethodSecurityExpressionHandler, then compare their null handling with ExpressionBasedPostInvocationAdvice under the legacy configuration. Reproduce the example with @EnableMethodSecurity and @EnableGlobalMethodSecurity; done means the null-return behavior is resolved consistently or the documented migration behavior is made explicit.