ServerHttpSecurity extracts WebFilter from OrderedWebFilter

Fixes gh-4736

config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java

@@ -249,7 +249,14 @@ public class ServerHttpSecurity {
 			this.authorizeExchangeBuilder.configure(this);
 		}
 		AnnotationAwareOrderComparator.sort(this.webFilters);
-		return new MatcherSecurityWebFilterChain(getSecurityMatcher(), this.webFilters);
+		List<WebFilter> sortedWebFilters = new ArrayList<>();
+		this.webFilters.forEach( f -> {
+			if(f instanceof OrderedWebFilter) {
+				f = ((OrderedWebFilter)f).webFilter;
+			}
+			sortedWebFilters.add(f);
+		});
+		return new MatcherSecurityWebFilterChain(getSecurityMatcher(), sortedWebFilters);
 	}
 
 	private String buildToString() {