fix(opcua): a configured OpcUa:EnabledSecurityProfiles list replaces the default, so None can be dropped (#879)

ConfigurationBinder appends configured collection items to an existing list, so
the pre-filled [None, Sign, SignAndEncrypt] default made "drop None" a no-op:
every deployment that listed only the secure profiles still advertised an
unsigned/unencrypted None endpoint.

EnabledSecurityProfiles is now null by default; ResolveEnabledSecurityProfiles()
applies the unchanged three-profile default only when nothing is configured.
A set-but-empty list fails startup validation and BuildSecurityPolicies no
longer falls back to a None endpoint on empty input (it throws). Sweep of all
options classes found no other non-empty pre-filled collection default.

Tests: options binding (indexed, JSON, env forms, default, empty, bad name), a
booted-server wire test (no None endpoint, None connection refused with
BadSecurityPolicyRejected, secure connection works; default case is the control).

Claude-Session: https://claude.ai/code/session_01GT67ACmpMR7b9LGRPLijMi

scripts/validation/opcua-windows-service/BindRepro/Program.cs

@@ -8,4 +8,4 @@ var config = new ConfigurationBuilder().AddInMemoryCollection(new Dictionary<str
 }).Build();
 var options = new OpcUaApplicationHostOptions();
 config.GetSection("OpcUa").Bind(options);
-Console.WriteLine(string.Join(", ", options.EnabledSecurityProfiles));
+Console.WriteLine(string.Join(", ", options.ResolveEnabledSecurityProfiles()));

scripts/validation/opcua-windows-service/README.md

@@ -83,7 +83,7 @@ upgrade or rollback), so `baseline-host` and `install-baseline` are not needed:
   - the elevated administrator is refused on the worker pipe;
   - `script-runner` health and the PE cache.
 - **Findings, not gating.** The script records which endpoints the server advertises, and the result of a session over the
-  `None` endpoint (lmxopcua#879).
+  `None` endpoint (lmxopcua#879). The #879 fix landed after the 2026-11-12 windev run: a build with it must advertise no `None` endpoint when only the secure profiles are configured, and the `None` session must be refused.
 
 **Cleanup caution.** `Cleanup` deletes `OtOpcUaHost` with `sc.exe delete`. It deliberately does not run
 `scripts/install/Uninstall-Services.ps1`, because that script also stops and deletes `OtOpcUaWonderwareHistorian`, which