Spring Security spring-boot-starter-webflux to reduce path traversal capability

Expected Behavior

Reject path traversal url in Spring WebFlux, e.g. GET /download/..%2F..%2Fpasswords

We'd better add HttpFirewall to WebFlux as well.

Current Behavior

Current behavior allows downloading files with relative path.

Context