Upgrade to SpringBoot 2.7
We should upgrade to springboot 2.7:
https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-2.7-Release-Notes
As per https://spring.io/blog/2023/09/11/spring-boot-2-7-commercial-support-extension this should mean we're on some form of supported version until August 2025 (we don't pay for commercial support, but it still seems likely any important security issues will be fixed). See also https://spring.io/projects/spring-boot#support
We do use WebSecurityConfigurerAdapter so are likely to run in into it's deprecation:
However if it is only deprecated (i.e. can still be used in 2.7) then we should tackle that separately after the main upgrade.