SEC-3025: CORS: Add SpringMvcRequestMatchers.mvcPreFlightRequest

Rob Winch (Migrated from SEC-3025) said:

This should simply delegate to CorsUtils.isPreFlightRequest to allow preflight requests to pass through (permitAll). We keep this distinct to ensure that it is only used in Spring MVC which places certain guarantees that if CorsUtils.isPreFlightRequest returns true that no user code is executed.

It may be good to do a check to see if CrossOrigin is on the classpath since this is only intended to be used with MVC (which places certain guarantees that user code isn't executed). This also ensures that 4.2+ is being used.

This would be used with something like:

http
   .authorizeRequests()
       .matchers(mvcPreFlightRequest()).permitAll()
       ...

NOTE: We probably need to think about XML configuration...perhaps it is due time we introduce a mechanism for referring to a request matcher instance in intercept-url

Start by locating the Spring MVC request matcher entry points and the existing CorsUtils.isPreFlightRequest usage. Confirm how mvcPreFlightRequest() should permit preflight requests without invoking user code, and determine whether XML configuration is in scope; done means the matcher is available for the shown authorizeRequests() usage with appropriate coverage.