Custom Spring Security firewall is lost when using spring-boot-cloudfoundry and Actuator in a reactive web application

Spring security fixed an issue in WebFilterChainProxy by allowing clients to override the default instance of the firewall field (ServerWebExchangeFirewall) with whatever client wants to or adjust the behavior of the default StrictServerWebExchangeFirewall instance:

https://github.com/spring-projects/spring-security/issues/15974

However ReactiveCloudFoundryActuatorAutoConfiguration in the postProcess method overrides the default WebFilterChainProxy bean with new instance and ignoring any overrides of firewall the old bean had.

This causes apps that run on cloud foundry to not run the same way as they would outside of cloud foundry, and require my to disable cloud foundry management endpoints.

I think that's a bug

management:
  cloudfoundry:
    enabled: false

To test this behavior localy, set the VCAP_APPLICATION environment variable to something, json like.