Avoid final-field mutation in security tests

[gregjotau]

Closes gh-19520

WebTestUtils currently replaces SecurityContextHolderFilter.securityContextRepository reflectively even though it is final. Current JDKs warn about this operation and state it will be blocked in a future release.

This adds a null-checked repository setter and uses it from test support. Reflective reads remain unchanged, so the new setter is the only additional production API.

Verification (JDK 25):

./gradlew :spring-security-web:test \
  --tests org.springframework.security.web.context.SecurityContextHolderFilterTests \
  :spring-security-test:test \
  --tests org.springframework.security.test.web.support.WebTestUtilsTests
./gradlew format