i18n the AccessDeniedException message

Expected Behavior

You should be able to internationalize the org.springframework.security.access.AccessDeniedException message in any place it is used.

Current Behavior

For now, the only place where the message can be internationalized is in the AccessDecisionMangagers (org.springframework.security.access.vote.AffirmativeBased, org.springframework.security.access.vote.ConsensusBased and org.springframework.security.access.vote.UnanimousBased) as all extend org.springframework.security.access.vote.AbstractAccessDecisionManager which has a org.springframework.context.support.MessageSourceAccesor and calls messages.getMessage("AbstractAccessDecisionManager.accessDenied", "Access is denied") to get the message.

org.springframework.security.access.expression.method.ExpressionBasedPostInvocationAdvice, org.springframework.security.access.prepost.PrePostAdviceReactiveMethodInterceptor, org.springframework.security.authorization.ReactiveAuthorizationManager, org.springframework.security.provisioning.InMemoryUserDetailsManager and org.springframework.security.provisioning.JdbcUserDetailsManager create new org.springframework.security.access.AuthorizationServiceException with hard-coded messages.

They should use the same org.springframework.context.support.MessageSourceAccesor mechanism that org.springframework.security.access.vote.AbstractAccessDecisionManager is using to allow i18n.

The same with org.springframework.security.access.vote.AbstractAclVoter (as it creates a new org.springframework.security.access.AuthorizationServiceException -that extends org.springframework.security.access.AccessDeniedException- with hard-coded message).

Also with org.springframework.security.web.server.csrf.CsrfWebFilter, org.springframework.security.web.csrf.MissingCsrfTokenException and org.springframework.security.web.csrf.InvalidCsrfTokenException (create or extend org.springframework.security.web.csrf.CsrfException -that extends org.springframework.security.access.AccessDeniedException- with hard-coded message).

And, finally, org.springframework.security.web.server.csrf.CsrfWebFilter (as it creates a new org.springframework.security.web.server.csrf.CsrfException -that extends org.springframework.security.access.AccessDeniedException- with hard-coded message).

Context

I'm trying to fully internationalize my application (and Exception messages are part of that) but looks like most Exceptions have hard-coded messages and that almost nobody uses things like e.getLocalizedMessage() cause there is almost no support for that (most of the times this method only delegates to e.getMessage())

PS: It would be great if any Spring Exception could extend a base Exception with localization support so you don't need to be aware of the MessageSourceAccesor or anything like that (but be aware of provide the message key and parameters for the message, in case those are required)