feat: Document VaadinSecurityConfigurer

[mshabarov]

Upgrades the Navigation Access Control docs to use VaadinSecurityConfigurer.
Adds API description for VaadinSecurityConfigurer and examples (perhaps deserves a separate chapter).
Upgrades Enable Security chapter to use VSC.
Upgrades other articles where VaadinWebSecurity was used.
Splits all related code examples into two tabs: one for VaadinSecurityConfigurer and other for deprecated VaadinWebSecurity.

Part-of #4298

[tltv]

I've updated all remaining pages for VaadinSecurityConfigurer. Code examples are split in two tabs, one for new VaadinSecurityConfigurer, other for deprecated VaadinWebSecurity.

This PR assumes that VaadinWebSecurity class will be deprecated starting from 24.8 to be removed in next major release.

[fredpena]

Suggestion: Update for Spring 6.5+ compatibility

[fredpena]

Suggestion: Update for Spring 6.5+ compatibility

As of Spring Security 6.5, AntPathRequestMatcher is deprecated. It is recommended to use the new path matching mechanism based on PathPatternParser, which offers better integration with Spring’s routing system.

Instead of:

http.authorizeHttpRequests(auth -> auth
  .requestMatchers(new AntPathRequestMatcher("/public/**"))
  .permitAll());

It’s better to update to:

http.authorizeHttpRequests(auth -> auth
  .requestMatchers("/public/**")
  .permitAll());

Here’s a more advanced example using the recommended syntax:

http.authorizeHttpRequests(authorize -> authorize
        .requestMatchers("/images/*.png", "/icons/**")
        .permitAll()
        .requestMatchers("/public/**")
        .anonymous()
        .requestMatchers("/admin/**")
        .hasRole("ADMIN"));

This not only simplifies the code but also ensures future compatibility and removes deprecation warnings in newer Spring versions.

[mcollovati]

Most likely the VaadinWebSecurity example should be updated in the same way

[tltv]

We discussed this topic and concluded that AuthenticationManagerBuilder is still supported with newer Spring, but it's not recommended way anymore. Therefore using it in old examples is acceptable.

However, it may seem a bit weird that the two side-by-side example configure a non-Vaadin related bean in different ways.

But in other hand, keeping old example as is may work as a nicer transition to newer API for old users. New users probably just ignore deprecated example anyway. Deprecated example will be removed in Vaadin 25 docs.