The request was rejected because the URL was not normalized.

Para que funcionasse corretamente e ficasse compatível com as minhas configurações, tive que alterar as versões do Spring Security para 5.0.6. Os testes funcionaram corretamente, porém quebrou na execução pela web:

GRAVE: Servlet.service() for servlet [dispatcher] in context with path [/casadocodigo] threw exception
org.springframework.security.web.firewall.RequestRejectedException: The request was rejected because the URL was not normalized.
    at org.springframework.security.web.firewall.StrictHttpFirewall.getFirewalledRequest(StrictHttpFirewall.java:248)
    at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:194)
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178)
    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:357)
    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:270)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
    at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:690)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
    at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:373)
    at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
    at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1590)
    at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.lang.Thread.run(Thread.java:748)

Pelo que vi ele deu erro na jsp do carrinho, quando tenta acessar uma imagem da pasta /resource/imagens:

<input type="image" src="${contextPath }/resources/imagens/excluir.png" alt="Excluir" title="Excluir" />

Ao comentar essa linha da jsp, a página funciona corretamente.Na classe SecurityConfiguration, a permissão está lá, mas aparentemente não funciona:

@Override
    protected void configure(HttpSecurity http) throws Exception {

        http.authorizeRequests()
            .antMatchers("/produtos/form").hasAnyRole("ADMIN")
            .antMatchers("/carrinho/**").permitAll() 
            .antMatchers(HttpMethod.POST, "/produtos").hasRole("ADMIN") 
            .antMatchers(HttpMethod.GET, "/produtos").permitAll() 
            .antMatchers("/produtos/**").permitAll() 
            .antMatchers("/").permitAll()
            .antMatchers("/resources/**").permitAll() 
            .anyRequest().authenticated() 
            .and().formLogin().loginPage("/login").permitAll()        
            .and().logout().logoutRequestMatcher(new AntPathRequestMatcher("/logout")); 
    }

Alguma luz?