Related to #16672, Spring Security 7 should validate the JWT `typ` header by default instead of delegating that to Nimbus.
