fix(security): deny unauthenticated access by default

[Isaries]

Summary

The security configuration had no default-deny rule, so any request that did not match a specific rule was permitted. Endpoints were therefore exposed unless someone remembered to restrict them explicitly. This denies unmatched requests by default and adds an explicit allowlist of the endpoints that must stay public.

Changes

• Add anyRequest().authenticated() as the final rule, with an allowlist of the genuinely public endpoints: sign-in and its OAuth callbacks, account registration, account and password recovery, the contact form, the public home, news, library and preview content, and the application bootstrap configuration.
• Permit the static asset paths served by the resource handlers (portal scripts, themes and translations, the runtime engine, project files and project icons). Student uploaded files are intentionally left requiring authentication.

Why this is a draft

This changes runtime access for every path that does not match an explicit rule, so it needs verification on a running instance before merging:

• Confirm every anonymous flow still works: sign-in, student and teacher registration, account and password recovery, the public home, library and community listings, and project preview.
• Confirm no legitimate endpoint was missed from the allowlist.
• Confirm the static asset paths load for signed-out visitors (this depends on whether they are served by the app or by a fronting web server in a given deployment).

Testing

• Builds on JDK 17 (mvnw package).