Add XML configuration guidance to deprecation warnings

When using XML-based Spring Security configuration, the standard
<intercept-url> elements internally translate to the deprecated
authorizeRequests mechanism, causing warnings that cannot be resolved
by XML users.

This change adds clarification to the deprecation warnings, informing
XML users that:
1. The warning can be ignored for XML configurations
2. They should continue using standard <intercept-url> elements
3. The deprecation only affects Java/Kotlin configuration users

This resolves the confusion for XML users who receive deprecation
warnings despite using officially supported XML configuration.

Closes gh-17259

Signed-off-by: khj68 <[email protected]>

Author: khj68

config/src/main/java/org/springframework/security/config/http/DefaultFilterChainValidator.java

@@ -126,11 +126,15 @@ private void checkAuthorizationFilters(List<SecurityFilterChain> chains) {
 			}
 			if (authorizationFilter != null && filterSecurityInterceptor != null) {
 				this.logger.warn(
-						"It is not recommended to use authorizeRequests or FilterSecurityInterceptor in the configuration. Please only use authorizeHttpRequests");
+						"It is not recommended to use authorizeRequests or FilterSecurityInterceptor in the configuration. Please only use authorizeHttpRequests. "
+								+ "Note: If using XML configuration, this warning can be ignored as XML <intercept-url> elements internally use the deprecated mechanism. "
+								+ "XML users should continue using standard <intercept-url> configuration.");
 			}
 			if (filterSecurityInterceptor != null) {
 				this.logger.warn(
-						"Usage of authorizeRequests and FilterSecurityInterceptor are deprecated. Please use authorizeHttpRequests in the configuration");
+						"Usage of authorizeRequests and FilterSecurityInterceptor are deprecated. Please use authorizeHttpRequests in the configuration. "
+								+ "Note: If using XML configuration, this warning can be ignored as XML <intercept-url> elements internally use the deprecated mechanism. "
+								+ "XML users should continue using standard <intercept-url> configuration.");
 			}
 			authorizationFilter = null;
 			filterSecurityInterceptor = null;