A way to re-enable CSRF for OAuth2 bearer token requests

We have user-facing services which are accessed via OAuth2 proxy, so they are configured as resource server and bearer token is added to request headers by the proxy (from client session).

Currently OAuth2ResourceServerConfigurer.registerDefaultCsrfOverride is called unconditionally and it makes it impossible to use conventional CSRF configuration.

On reactive side there seems to be a solution (not tested though): when custom requireCsrfProtectionMatcher is specified, the override is not applied. Similar behaviour could be implemented for servlet security by introducing specifiedRequireCsrfProtectionMatcher flag on CsrfConfigurer.