Fix exception wrapping issue with SecurityHandler

Fixes quarkusio#21679

(cherry picked from commit 46a2de0)

extensions/security/deployment/src/test/java/io/quarkus/security/test/cdi/CDIAccessDefaultTest.java

@@ -21,6 +21,7 @@
 import io.quarkus.security.test.cdi.app.SubclassWithDenyAll;
 import io.quarkus.security.test.cdi.app.SubclassWithPermitAll;
 import io.quarkus.security.test.cdi.app.SubclassWithoutAnnotations;
+import io.quarkus.security.test.cdi.app.TestException;
 import io.quarkus.security.test.utils.AuthData;
 import io.quarkus.security.test.utils.IdentityMock;
 import io.quarkus.security.test.utils.SecurityTestUtils;
@@ -53,6 +54,7 @@ public class CDIAccessDefaultTest {
                             AuthData.class,
                             SubclassWithDenyAll.class,
                             SubclassWithoutAnnotations.class,
+                            TestException.class,
                             SubclassWithPermitAll.class,
                             SecurityTestUtils.class));
 
@@ -101,6 +103,18 @@ public void shouldRestrictAccessToSpecificRoleCompletionState() {
         }, "accessibleForAdminOnly", ADMIN);
     }
 
+    @Test
+    public void testExceptionWrapping() {
+        Executable executable = () -> {
+            try {
+                bean.securedMethodCompletionStageException().toCompletableFuture().get();
+            } catch (ExecutionException e) {
+                throw e.getCause();
+            }
+        };
+        assertFailureFor(executable, TestException.class, ADMIN);
+    }
+
     @Test
     public void shouldFailToAccessForbiddenOnClass() {
         assertFailureFor(() -> denyAllBean.noAdditionalConstraints(), UnauthorizedException.class, ANONYMOUS);

extensions/security/deployment/src/test/java/io/quarkus/security/test/cdi/app/BeanWithSecuredMethods.java

@@ -37,6 +37,11 @@ public CompletionStage<String> securedMethodCompletionStage() {
         return Uni.createFrom().item("accessibleForAdminOnly").subscribeAsCompletionStage();
     }
 
+    @RolesAllowed("admin")
+    public CompletionStage<String> securedMethodCompletionStageException() {
+        throw new TestException();
+    }
+
     public String unsecuredMethod() {
         return "accessibleForAll";
     }

extensions/security/deployment/src/test/java/io/quarkus/security/test/cdi/app/TestException.java

@@ -0,0 +1,4 @@
+package io.quarkus.security.test.cdi.app;
+
+public class TestException extends RuntimeException {
+}

extensions/security/runtime/src/main/java/io/quarkus/security/runtime/interceptor/SecurityHandler.java

@@ -36,7 +36,7 @@ public Object handle(InvocationContext ic) throws Exception {
                         try {
                             return Uni.createFrom().completionStage((CompletionStage<?>) ic.proceed());
                         } catch (Exception e) {
-                            throw new RuntimeException(e);
+                            return Uni.createFrom().failure(e);
                         }
                     }).subscribeAsCompletionStage();
         } else if (Multi.class.isAssignableFrom(returnType)) {