See #29655 for background.
Comment From: mhalbritter
Spring Security 6.1.2 shipped in Boot 3.1.x auto-configures a RequestAttributeSecurityContextRepository if a stateless session is configured (see org.springframework.security.config.annotation.web.configurers.SessionManagementConfigurer#init).
There's nothing to document here.