code: private void updateSecurityMetadata(SecurityMetadata securityMetadataFromDD, WebAppConfig webAppConfig) {
          for (Iterator<IServletConfig> it = webAppConfig.getServletInfos(); it.hasNext();) {
              IServletConfig servletConfig = it.next();
              if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                  Tr.debug(tc, "Updating servlet: " + servletConfig.getServletName());
              }
              updateSecurityMetadataWithRunAs(securityMetadataFromDD, servletConfig);
              updateSecurityMetadataWithSecurityConstraints(securityMetadataFromDD, servletConfig);
          }
      }
docs: Updates the security metadata object (which at this time only has the deployment descriptor info)
  with the webAppConfig information comprising all sources.
  
  @param securityMetadataFromDD the security metadata processed from the deployment descriptor
  @param webAppConfig the web app configuration provided by the web container