HeaderWriterFilter headers not written on RequestDispatcher.forward() under Tomcat 11

Describe the bug
Spring Security's default response headers (Cache-Control, X-Content-Type-Options, X-XSS-Protection, X-Frame-Options, …) are not written on responses produced through a servlet RequestDispatcher.forward() when running on Tomcat 11. Hitting the same servlet directly returns all headers; only forwarded responses lose them, silently.

The trigger is Tomcat 11's changed default for the Context attribute suspendWrappedResponseAfterForward (false in Tomcat 10.1.x → true in Tomcat 11): after a forward, Catalina suspends/unwraps the wrapped response instead of closing it, so HeaderWriterFilter's OnCommittedResponseWrapper never receives its on-commit callback. The behavior tracks the Tomcat major version and is independent of the Spring Boot and Spring Security versions.

Setting HeaderWriterFilter.setShouldWriteHeadersEagerly(true) (or restoring suspendWrappedResponseAfterForward=false) works around it. Raising it here since HeaderWriterFilter is the component that silently omits the headers: should its default be made robust to Tomcat 11's behavior, or at least documented?

To Reproduce
The sample is a Spring Boot app with Spring Security (permitAll) and a servlet (TargetServlet) mapped at /target/*. It exposes the same servlet three ways (Application.java): directly (/target/*), via a URL forward request.getRequestDispatcher(...).forward(...) (/forward-url), and via a named-dispatcher forward using ServletForwardingController (/forward-named).

mvn clean package
java -jar target/ss-forward-mre-1.0.jar

curl -sD - -o /dev/null http://localhost:8090/target/direct    # headers PRESENT
curl -sD - -o /dev/null http://localhost:8090/forward-url      # headers MISSING
curl -sD - -o /dev/null http://localhost:8090/forward-named    # headers MISSING

Rebuilding against Tomcat 10.1.x (mvn clean package -Dtomcat.version=10.1.39) makes the forwarded responses keep the headers.
Likewise, on Tomcat 11 setting suspendWrappedResponseAfterForward=false restores them; run with --tomcat.suspend-fix=true (the sample wires this flag through a WebServerFactoryCustomizer).

Expected behavior
Responses produced via forward() carry the same Spring Security response headers as direct responses (the Tomcat 10.1 / Spring Boot 3.x behavior).

Sample

https://github.com/mcollovati/spring-security-forward-headers-tomcat11

Environment: Spring Boot 4.1.0, Spring Security 7.1.0, Tomcat 11.0.22, Java 21.

Start with HeaderWriterFilter and its OnCommittedResponseWrapper behavior, then reproduce the issue using the linked sample's Application.java. Run mvn clean package and the three curl requests on Tomcat 11, comparing direct and forwarded responses. Done means forwarded responses retain the same Spring Security headers as direct responses without relying on the documented workaround.