Spring Security After-invocation ACL providers cannot be used with Hibernate proxies

Describe the bug CollectionFilterer and the like use a HashSet to store elements to be removed which in turn calls equals() and hashCode(). This implies that a collection of Hibernate proxies would be initialized were they to be filtered out.

In some scenarios where a service method is annotated with @Secured calling another method annotated with @Transactional, this can cause lazy proxy initialization errors because the session is closed already.

Since the elements to remove are the same as those that will be removed later on when the collection is traversed, I suggest replacing this by an identity set.

To Reproduce

@Secured("AFTER_ACL_COLLECTION_READ")
public List<Entity> loadAllEntities(Collection<Long> ids) {
    return ids.stream().map(id -> sessionFactory.getCurrentSession().load()).collect(Collectors.toList());   
}

List<Entity> entities = loadAllEntities();

Expected behavior Entities are filtered, but should remain uninitialized since only IDs and classes are necessary for applying ACLs.