Posted an issue in Spring Security's GitHub, and apparently I had to add a dependency in jackson:
jackson
implementation group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.18.2'
I couldn't see this documented anywhere..