Deprecate SecurityConfig

Closes gh-16773

Author: jzheaux

config/src/main/java/org/springframework/security/config/http/ChannelAttributeFactory.java

@@ -21,6 +21,8 @@
 import org.springframework.beans.factory.BeanCreationException;
 import org.springframework.security.access.ConfigAttribute;
 import org.springframework.security.access.SecurityConfig;
+import org.springframework.security.authorization.AuthorizationManager;
+import org.springframework.security.core.annotation.SecurityAnnotationScanner;
 import org.springframework.security.web.access.channel.ChannelDecisionManagerImpl;
 
 /**
@@ -29,7 +31,14 @@
  *
  * @author Luke Taylor
  * @since 3.0
+ * @deprecated In modern Spring Security APIs, each API manages its own configuration
+ * context. As such there is no direct replacement for this interface. In the case of
+ * method security, please see {@link SecurityAnnotationScanner} and
+ * {@link AuthorizationManager}. In the case of channel security, please see
+ * {@code HttpsRedirectFilter}. In the case of web security, please see
+ * {@link AuthorizationManager}.
  */
+@Deprecated
 public final class ChannelAttributeFactory {
 
 	private static final String OPT_REQUIRES_HTTP = "http";

core/src/main/java/org/springframework/security/access/SecurityConfig.java

@@ -20,14 +20,23 @@
 import java.util.ArrayList;
 import java.util.List;
 
+import org.springframework.security.authorization.AuthorizationManager;
+import org.springframework.security.core.annotation.SecurityAnnotationScanner;
 import org.springframework.util.Assert;
 import org.springframework.util.StringUtils;
 
 /**
  * Stores a {@link ConfigAttribute} as a <code>String</code>.
  *
  * @author Ben Alex
+ * @deprecated In modern Spring Security APIs, each API manages its own configuration
+ * context. As such there is no direct replacement for this interface. In the case of
+ * method security, please see {@link SecurityAnnotationScanner} and
+ * {@link AuthorizationManager}. In the case of channel security, please see
+ * {@code HttpsRedirectFilter}. In the case of web security, please see
+ * {@link AuthorizationManager}.
  */
+@Deprecated
 public class SecurityConfig implements ConfigAttribute {
 
 	@Serial