Expected Behavior
I expect to be able to provide my own implementations for PublicKeyCredentialCreationOptionsRepository and HttpMessageConverter when using passkeys/webauthn, specifically to be able to save/load the options outside of a session.

e.g.,

@Bean
SecurityFilterChain webAuthnFilterChain(HttpSecurity http) throws Exception {
  return http.webAuthn(webAuthn -> { ... }).build();
}
  
@Bean
B2cPublicKeyCredentialCreationOptionsRepository customCreationOptionsRepo() {
  return new MyCustomB2cPublicKeyCredentialCreationOptionsRepository();
}

Current Behavior
The webauthn filters just initialize their own instances on construction:
https://github.com/spring-projects/spring-security/blob/main/web/src/main/java/org/springframework/security/web/webauthn/registration/PublicKeyCredentialCreationOptionsFilter.java#L59

WebAuthnRegistrationFilter at least has a setter to update it, but I'd have to use reflection to update PublicKeyCredentialCreationOptionsFilter.

Context
I have another server forwarding the webauthn requests to a spring boot server, and will be storing the state externally and not in a session. My current workaround is to use reflection to update the private fields to use my implementation of B2cPublicKeyCredentialCreationOptionsRepository, but I feel that dependencies should be injected so they can be customized.