Fix CORS configuration in /cloudfoundryapplication security filter

Previously, Spring Security wouldn't necessary allow cross-origin
requests to /cloudfoundryapplication, despite the underlying handler
mapping doing so.

Since 6.2, Spring Security enables CORS with default configuration if
there are any UrlBasedCorsConfigurationSource beans in the context.
This default configuration will then use a bean named
corsConfigurationSource as its source of CORS configuration. If it
doesn't find such a bean, it'll use the mvcHandlerMappingIntrospector
bean as a source. This latter case works as it means that the
CORS configuration of the underlying handler mapping is used.

In the case where a bean named corsConfigurationSource is used, this
will break /cloudfoundryapplication if the bean's CORS configuration
for /cloudfoundryapplication does not allow it. This has only been
a problem since Spring Boot 3.5 where we switched from using
ignoring() to using permitAll() to configure the security of
/cloudfoundryapplication.

To avoid a user-provided bean named corsConfigurationSource from
accidentally preventing access to /cloudfoundryapplication, we now
explicitly configure the filter chain's CORS support to use the same
CorsConfigurationSource as the handler mapping.

Fixes gh-50254