Add getName to SecurityFilterChain for trace logging

[LivingLikeKrillin]

Closes gh-6274

Background

This issue has had two prior attempts at resolution:

• Support name for securityFilterChain #6288 (BeanNameAware on DefaultSecurityFilterChain) — closed, not merged
• Better logging support by id in RequestMatcher #6308 (getId() on RequestMatcher) — closed, not merged

Since then, in commit f46e56d (gh-15874), BeanNameAware was added to
DefaultSecurityFilterChain to improve error messages. The bean name is now
captured and surfaced through toString(), but the SecurityFilterChain
interface itself still has no name accessor, so consumers like
FilterChainProxy cannot include the matched chain identity in
"Securing/Secured" debug logs without instanceof checks.

Change

• Add default @Nullable String getName() to SecurityFilterChain
  (returns null by default — fully backward compatible).
• Override in DefaultSecurityFilterChain to return the bean name
  captured by the existing BeanNameAware integration.
• Update FilterChainProxy.doFilterInternal to include [<name>] in
  DEBUG logs when a name is available; omit when null.

Commit-by-commit reviewability

The PR is split into six small commits so each can be reviewed in isolation:

1. Add getName default to SecurityFilterChain — interface change only
2. Override getName in DefaultSecurityFilterChain — bean-name override
3. Extract matchChain helper in FilterChainProxy — pure refactor, no behavior change
4. Include chain name in FilterChainProxy DEBUG log — the visible behavioral change
5. Add WebTestUtils.findFilter regression test for FilterChainProxy
6. Add getFilters(HttpServletRequest) regression test for CompositeFilterChainProxy

Happy to squash if the team prefers a single commit, but kept separate so the
"no behavior change" refactor (3) can be verified independently from the
behavioral change (4).

Preservation of the reflective getFilters(HttpServletRequest) contract

The existing private FilterChainProxy.getFilters(HttpServletRequest) is
preserved verbatim (name and signature). It is invoked reflectively by
WebTestUtils.findFilter at WebTestUtils.java:158 via
ReflectionTestUtils.invokeMethod(springSecurityFilterChain, "getFilters", request),
and an analogous private method exists on CompositeFilterChainProxy for the
same reason. The new matchChain helper is added alongside it, and
getFilters(HttpServletRequest) now delegates to matchChain. Two regression
tests lock this contract for both FilterChainProxy and
CompositeFilterChainProxy.

Why @Nullable String rather than Optional<String>

Return type is @Nullable String rather than Optional<String> for
consistency with the existing @Nullable beanName field on
DefaultSecurityFilterChain, and following Brian Goetz's guidance that
Optional is awkward as a property-style return type. The new method's
Javadoc explicitly marks the returned value as for diagnostic use only.

Out of scope (deliberately)

• No setter on the interface. BeanNameAware covers the common path;
  custom implementations can return their own identity by overriding
  getName().
• No reactive parity. SecurityWebFilterChain lacks BeanNameAware
  groundwork (no equivalent of f46e56de78 on the reactive side yet), so
  that change is meaningfully different. If this lands, I will open a
  separate issue for SecurityWebFilterChain parity.
• No changes to DebugFilter or DefaultFilterChainValidator. Those
  consumers can adopt getName() in follow-up PRs once the interface
  change lands.

Alternative considered

If the team prefers to avoid an interface change, the same DEBUG output
can be achieved via an instanceof DefaultSecurityFilterChain cast in
FilterChainProxy. Happy to switch to that diff if a cast-based approach
is preferred.

Testing

• SecurityFilterChainTests — interface default returns null.
• DefaultSecurityFilterChainTests — getName() returns the bean name when
  set; null otherwise.
• FilterChainProxyTests — DEBUG log includes [<name>] suffix when the
  matched chain has a name; suffix omitted when null. Uses logback
  ListAppender for log capture.
• WebTestUtilsTests — regression test for the reflective contract on
  plain FilterChainProxy.
• CompositeFilterChainProxyTests — regression test for the same contract
  on WebSecurityConfiguration.CompositeFilterChainProxy (the package-private
  composite path used by Spring Boot annotation-based config).

Notes

• No try/catch around getName() in FilterChainProxy, consistent with how
  matches() and getFilters() are already invoked. Diagnostics should
  not silently swallow exceptions.
• Existing log scrapers using prefix matching (startsWith("Securing"))
  are unaffected. End-anchored regexes (^Securing .* /\S+$) may need
  adjustment.