Vaadin 24 LTS @AnonymousAllowed enforcement change breaks Spring Security test integration

Context

Vaadin 24 LTS tightened enforcement of @AnonymousAllowed so that navigation now requires explicit permission even when a mock user exists in the Spring Security test context. This change affects integration tests that rely on @SpringBootTest with @WithMockUser to exercise views without production credentials.

Problem

When the Spring Security filter chain is not fully initialized in a test slice, views annotated only with @AnonymousAllowed still redirect to the login page. Vaadin TestBench offers a bypass by setting a test‑specific VaadinSession attribute, yet this mechanism is not automatically wired to Spring Security's test user. The framework currently leaves it unresolved whether the UI tier should honor @WithMockUser automatically or require developers to populate VaadinSecurityContext manually in tests.

Open questions

1. Should Vaadin Flow automatically synchronize Spring Security's test authentication into VaadinSecurityContext during @SpringBootTest execution?
2. Is there a supported configuration that makes @AnonymousAllowed behave consistently between Vaadin 23 LTS and 24 LTS without modifying test code?
3. What is the recommended pattern for integration tests that need both Spring Security method security (@PreAuthorize) and Vaadin navigation authorization to align in a test slice?