[bs-153] Don't expose classes as resource

Made classpath:/[static,resourecs,public] available instead. Some
sample apps had to change so probably some gs-* guides etc as well?

[Fixes #51368907]

spring-autoconfigure/src/main/java/org/springframework/autoconfigure/web/WebMvcAutoConfiguration.java

@@ -121,16 +121,12 @@ public class WebMvcAutoConfiguration {
 
 		@Override
 		public void addResourceHandlers(ResourceHandlerRegistry registry) {
-			// FIXME exposing the root classpath is a security risk
+			registry.addResourceHandler("/resources/**").addResourceLocations("/",
-			// eg http://localhost:8080/org/springframework/bootstrap/Banner.class
+					"classpath:/META-INF/resources/", "classpath:/resources/",
-			registry.addResourceHandler("/resources/**").addResourceLocations("/")
+					"classpath:/public/", "classpath:/static/");
-					.addResourceLocations("classpath:/META-INF/resources/")
+			registry.addResourceHandler("/**").addResourceLocations("/",
-					.addResourceLocations("classpath:/resources/")
+					"classpath:/META-INF/resources/", "classpath:/resources/",
-					.addResourceLocations("classpath:/");
+					"classpath:/static/", "classpath:/public/");
-			registry.addResourceHandler("/**").addResourceLocations("/")
-					.addResourceLocations("classpath:/META-INF/resources/")
-					.addResourceLocations("classpath:/static/")
-					.addResourceLocations("classpath:/");
 		}
 
 		@Configuration

spring-zero-samples/spring-zero-sample-web-ui/src/test/java/org/springframework/zero/sample/web/ui/SampleWebUiApplicationTests.java

@@ -78,7 +78,7 @@ public class SampleWebUiApplicationTests {
 	@Test
 	public void testCss() throws Exception {
 		ResponseEntity<String> entity = getRestTemplate().getForEntity(
-				"http://localhost:8080/css/bootstrap.min.css", String.class);
+				"http://localhost:8080/resources/css/bootstrap.min.css", String.class);
 		assertEquals(HttpStatus.OK, entity.getStatusCode());
 		assertTrue("Wrong body:\n" + entity.getBody(), entity.getBody().contains("body"));
 	}