Fix OAuth2LoginConfigurer AuthenticationProvider decoration

[seeun0210]

Summary

This PR fixes the issue where OAuth2LoginConfigurer was not properly supporting ObjectPostProcessor<AuthenticationProvider> decoration due to type casting issues.

Problem

Currently, the postProcess method in OAuth2LoginConfigurer returns concrete types (OAuth2LoginAuthenticationProvider and OidcAuthorizationCodeAuthenticationProvider) instead of the AuthenticationProvider interface. This makes it difficult for users to decorate these providers with custom ObjectPostProcessor implementations.

Solution

• Cast the result of postProcess() to AuthenticationProvider interface in both OAuth2 and OIDC authentication provider registrations
• This enables users to apply custom ObjectPostProcessor<AuthenticationProvider> implementations
• Added comprehensive test coverage for OIDC AuthenticationProvider postProcess functionality

Changes

Code Changes

• File: config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OAuth2LoginConfigurer.java
• Lines 347 & 368: Added explicit casting to AuthenticationProvider interface

// Before
http.authenticationProvider(this.postProcess(oauth2LoginAuthenticationProvider));
http.authenticationProvider(this.postProcess(oidcAuthorizationCodeAuthenticationProvider));

// After  
http.authenticationProvider((AuthenticationProvider) this.postProcess(oauth2LoginAuthenticationProvider));
http.authenticationProvider((AuthenticationProvider) this.postProcess(oidcAuthorizationCodeAuthenticationProvider));

Test Changes

• File: config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OAuth2LoginConfigurerTests.java
• Added oauth2LoginWhenOidcAuthenticationProviderPostProcessorThenUses() test method
• Added OAuth2LoginConfigCustomWithOidcPostProcessor test configuration class
• Added OidcSpyObjectPostProcessor for testing OIDC provider decoration

Benefits

This change enables developers to:

• Add pre/post authentication logic
• Implement custom security validations
• Add logging and monitoring capabilities
• Apply cross-cutting concerns like caching or rate limiting
• Decorate OAuth2 and OIDC authentication providers with custom logic

Testing

• Existing tests continue to pass
• New test verifies OIDC AuthenticationProvider postProcess functionality
• Test uses Mockito spy to verify that the postProcess method is called correctly

Related Issue

Closes gh-17357