See #29655 for background.

Comment From: mhalbritter

Spring Security 6.1.2 shipped in Boot 3.1.x auto-configures a RequestAttributeSecurityContextRepository if a stateless session is configured (see org.springframework.security.config.annotation.web.configurers.SessionManagementConfigurer#init).

There's nothing to document here.