Publishing a default TargetVisitor should not override Spring MVC support

Closes gh-17185

Signed-off-by: Evgeniy Cheban <mister.cheban@gmail.com>

Author: evgeniycheban

config/src/main/java/org/springframework/security/config/annotation/method/configuration/AuthorizationProxyWebConfiguration.java

@@ -26,6 +26,7 @@
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Role;
+import org.springframework.core.Ordered;
 import org.springframework.http.HttpEntity;
 import org.springframework.http.ResponseEntity;
 import org.springframework.security.access.AccessDeniedException;
@@ -58,7 +59,9 @@ public void extendHandlerExceptionResolvers(List<HandlerExceptionResolver> resol
 		resolvers.add(new AccessDeniedExceptionResolver());
 	}
 
-	static class WebTargetVisitor implements AuthorizationAdvisorProxyFactory.TargetVisitor {
+	static class WebTargetVisitor implements AuthorizationAdvisorProxyFactory.TargetVisitor, Ordered {
+
+		private static final int DEFAULT_ORDER = 100;
 
 		@Override
 		public Object visit(AuthorizationAdvisorProxyFactory proxyFactory, Object target) {
@@ -81,6 +84,11 @@ public Object visit(AuthorizationAdvisorProxyFactory proxyFactory, Object target
 			return null;
 		}
 
+		@Override
+		public int getOrder() {
+			return DEFAULT_ORDER;
+		}
+
 	}
 
 	static class AccessDeniedExceptionResolver implements HandlerExceptionResolver {