feat(#1531)!: change default custom validator mode from EXCLUSIVE to COMBINED

[bbortt]

When a custom validator is provided, it previously ran exclusively, silently bypassing all other validation. This means any other constraints passed to validate() was simply ignored. This BREAKING CHANGE changes the default custom validator mode from EXCLUSIVE to COMBINED, so that custom validators run alongside other validation rather than replacing it.

Users who genuinely need the old exclusive behaviour can still opt in explicitly, but the footgun default is gone.

BREAKING CHANGE: Change default custom validator mode from EXCLUSIVE to COMBINED.

Closes #1531.

[bbortt]

actually, now I am not so sure if this is a good idea. it also forces you to add e.g. body validation in MessageStoreTest despite the fact, that you maybe don't want to do this:

[christophd]

ah ok, this is not what we want.

Is it complaining about a missing validation context validation?

[bbortt]

yes. I din't have time to look further into it. but there was a hanging body validation context, I think. and some default message validators were also not being validated e.g. on HTTP DELETE requests where there is no response body at all.

maybe if we refactor the default validarion context mechanism, but anyway it isn't as straight forward as I thought.

[bbortt]

I did some more thinking during dancing classes @christophd 😂 I think the most straight forward approach would be to throw an exception where there is just a warning log in place today.

having default validators and custom validator in place, with EXCLUSIVE mode is simply useless. default validators won't be taken into account.

in order not to break the API we added a warning log, previously. now I think we should throw an exception, to remove the chance of any false-positives.

or am I missing something?