Hide utility class constructors

Update all utility classes so that they have a private constructor. This
prevents users from accidentally creating an instance, when they should
just use the static methods directly.

Issue gh-8945

web/src/main/java/org/springframework/security/web/WebAttributes.java

@@ -52,4 +52,7 @@ public final class WebAttributes {
 	public static final String WEB_INVOCATION_PRIVILEGE_EVALUATOR_ATTRIBUTE = WebAttributes.class.getName()
 			+ ".WEB_INVOCATION_PRIVILEGE_EVALUATOR_ATTRIBUTE";
 
+	private WebAttributes() {
+	}
+
 }

web/src/main/java/org/springframework/security/web/authentication/www/DigestAuthUtils.java

@@ -31,6 +31,9 @@ final class DigestAuthUtils {
 
 	private static final String[] EMPTY_STRING_ARRAY = new String[0];
 
+	private DigestAuthUtils() {
+	}
+
 	static String encodePasswordInA1Format(String username, String realm, String password) {
 		String a1 = username + ":" + realm + ":" + password;
 

web/src/main/java/org/springframework/security/web/savedrequest/FastHttpDateFormat.java

@@ -32,7 +32,7 @@ import java.util.TimeZone;
  * @author Remy Maucherat
  * @author Andrey Grebnev
  */
-public class FastHttpDateFormat {
+public final class FastHttpDateFormat {
 
 	/** HTTP date format. */
 	protected static final SimpleDateFormat format = new SimpleDateFormat("EEE, dd MMM yyyy HH:mm:ss zzz", Locale.US);
@@ -66,6 +66,9 @@ public class FastHttpDateFormat {
 	/** Parser cache. */
 	protected static final HashMap<String, Long> parseCache = new HashMap<>();
 
+	private FastHttpDateFormat() {
+	}
+
 	/**
 	 * Formats a specified date to HTTP format. If local format is not <code>null</code>,
 	 * it's used instead.

web/src/main/java/org/springframework/security/web/util/UrlUtils.java

@@ -30,6 +30,9 @@ import javax.servlet.http.HttpServletRequest;
  */
 public final class UrlUtils {
 
+	private UrlUtils() {
+	}
+
 	public static String buildFullRequestUrl(HttpServletRequest r) {
 		return buildFullRequestUrl(r.getScheme(), r.getServerName(), r.getServerPort(), r.getRequestURI(),
 				r.getQueryString());

web/src/test/java/org/springframework/security/test/web/reactive/server/WebTestClientBuilder.java

@@ -34,7 +34,10 @@ import org.springframework.web.server.WebFilter;
  * @since 5.0
  *
  */
-public class WebTestClientBuilder {
+public final class WebTestClientBuilder {
+
+	private WebTestClientBuilder() {
+	}
 
 	public static Builder bindToWebFilters(WebFilter... webFilters) {
 		return WebTestClient.bindToController(new Http200RestController()).webFilter(webFilters).configureClient();

web/src/test/java/org/springframework/security/web/authentication/preauth/x509/X509TestUtils.java

@@ -25,7 +25,10 @@ import java.security.cert.X509Certificate;
  *
  * @author Luke Taylor
  */
-public class X509TestUtils {
+public final class X509TestUtils {
+
+	private X509TestUtils() {
+	}
 
 	/**
 	 * Builds an X.509 certificate. In human-readable form it is: