@RolesAllowed annotation broken for resources returning a Multi
### Describe the bug

`@RolesAllowed` is being ignored for endpoints returning a Multi. I think the issue introduced by #21270




### Expected behavior

When expected roles are missing, API should fail with Forbidden Error (403)

### Actual behavior

Received 200 OK response

### How to Reproduce?

https://github.com/mvmandapati/reactive-routes

Steps:

1. Run mvn clean verify to see the failure

### Output of `uname -a` or `ver`

_No response_

### Output of `java -version`

OpenJDK Runtime Environment Temurin-17+35 (build 17+35) OpenJDK 64-Bit Server VM Temurin-17+35 (build 17+35, mixed mode, sharing)

### GraalVM version (if different from Java)

_No response_

### Quarkus version or git rev

2.4.2

### Build tool (ie. output of `mvnw --version` or `gradlew --version`)

Apache Maven 3.8.1

### Additional information

_No response_
diff --git a/extensions/security/runtime/src/main/java/io/quarkus/security/runtime/interceptor/SecurityHandler.java b/extensions/security/runtime/src/main/java/io/quarkus/security/runtime/interceptor/SecurityHandler.java
index 7d2474d0730..209d37d1ab4 100644
--- a/extensions/security/runtime/src/main/java/io/quarkus/security/runtime/interceptor/SecurityHandler.java
+++ b/extensions/security/runtime/src/main/java/io/quarkus/security/runtime/interceptor/SecurityHandler.java
@@ -41,9 +41,7 @@ public Object handle(InvocationContext ic) throws Exception {
                     }).subscribeAsCompletionStage();
         } else if (Multi.class.isAssignableFrom(returnType)) {
             return constrainer.nonBlockingCheck(ic.getMethod(), ic.getParameters())
-                    // Do not use transformToMulti as we want to preserve the type of multi produced by the user method.
-                    // This is required for Reactive Routes to handle custom Multi serialization.
-                    .toMulti().plug(x -> new MultiContinuation(ic).apply(x));
+                    .onItem().transformToMulti(new MultiContinuation(ic));
         } else {
             constrainer.check(ic.getMethod(), ic.getParameters());
             return ic.proceed();
['extensions/security/runtime/src/main/java/io/quarkus/security/runtime/interceptor/SecurityHandler.java']