Is your feature request related to a problem? Please describe.

General identity attributes (enduser.id, enduser.role, enduser.scope) are not captured for SERVER spans in applications using Spring Security OAuth2 Resource Server for Servlet or WebFlux based applications.

The existing servlet instrumentation currently captures the enduser.id in a couple places (here and here). However, in an Servlet-based application using Spring Security OAuth2 Resource Server, the request.getUserPrincipal() returns null at this level. It returns null here because Spring Security wraps that request object in a request wrapper at a higher level, and the user principal is only returned from the wrapper at the higher level. In other words, since the servlet instrumentation only has access to the lower level request, and not the higher level request wrapper, the user principal seen by the servlet instrumentation is null, and therefore the enduser.id is not captured.

In addition, there is no existing instrumentation for capturing the enduser.id in WebFlux applications.

Describe the solution you'd like

I would like general identity attributes (enduser.id, enduser.role, enduser.scope) to be captured for SERVER spans in applications using Spring Security OAuth2 Resource Server for Servlet and WebFlux based applications.

Describe alternatives you've considered

No response

Additional context

While the new instrumentation probably needs to be Spring Security specific, it does not necessarily need to be specific to OAuth2 Resource Servers authentication/authorization. i.e. The new instrumentation could probably work for any type of Spring Security based authentication/authorization.