Spring Security HttpSecurity should allow for AuthorizationManager<? super RequestAuthorizationContext>

This allows an AuthorizationManager<Object> to be used. Similarly we should allow for AuthorizationManagerFactory<? super RequestAuthorizationContext>

NOTE: This worked because if AuthorizationManager<RequestAuthorizationContext> was not found it would look for AuthorizationManager<Object> as a fall back. Due to type erasure it was able to assign it to RequestMatcherDelegatingAuthorizationManager even though it wasn't the right type.

See https://github.com/spring-projects/spring-framework/issues/31444

Comment From: therepanic

Hi, @rwinch. May I also implement this issue?

Comment From: rwinch

@therepanic Sorry. I missed assigning it to myself and I'm nearly done with it