Improve And/Or-RequestMatcher/ServerWebExchangeMatcher API

[ziqin]

Currently, the List-receiving constructors of AndRequestMatcher, OrRequestMatcher, AndServerWebExchangeMatcher, and OrServerWebExchangeMatcher don't support covariance, which adds obstacles to users of these APIs. For example, one cannot pass a List<PathPatternRequestMatcher> to OrRequestMatcher(List<RequestMatcher>).

This PR resolves the aforementioned problem. It should not break existing code.

[ziqin]

I discovered this problem when working on PR #18499, where I had to explicitly specify the return of builder::matcher as the interface RequestMatcher so that I can get a List<RequestMatcher> instead of List<PathPatternRequestMatcher>.

spring-security/config/src/main/java/org/springframework/security/config/annotation/web/configurers/HeadersConfigurer.java

Lines 1031 to 1039 in b18c078

	public ContentSecurityPolicyConfig requireCspMatchers(String... pathPatterns) {
	PathPatternRequestMatcher.Builder builder = HeadersConfigurer.this.getRequestMatcherBuilder();
	// @formatter:off
	return this.requireCspMatcher(new OrRequestMatcher(
	Arrays.stream(pathPatterns)
	.map((Function<? super String, RequestMatcher>) builder::matcher)
	.toList()));
	// @formatter:on
	}

If this PR is merged, we can simply use Arrays.stream(pathPatterns).map(builder::matcher).toList().