fix(opcua): a configured OpcUa:EnabledSecurityProfiles list replaces the default, so None can be dropped (#879)

ConfigurationBinder appends configured collection items to an existing list, so
the pre-filled [None, Sign, SignAndEncrypt] default made "drop None" a no-op:
every deployment that listed only the secure profiles still advertised an
unsigned/unencrypted None endpoint.

EnabledSecurityProfiles is now null by default; ResolveEnabledSecurityProfiles()
applies the unchanged three-profile default only when nothing is configured.
A set-but-empty list fails startup validation and BuildSecurityPolicies no
longer falls back to a None endpoint on empty input (it throws). Sweep of all
options classes found no other non-empty pre-filled collection default.

Tests: options binding (indexed, JSON, env forms, default, empty, bad name), a
booted-server wire test (no None endpoint, None connection refused with
BadSecurityPolicyRejected, secure connection works; default case is the control).

Claude-Session: https://claude.ai/code/session_01GT67ACmpMR7b9LGRPLijMi

scripts/validation/opcua-windows-service/BindRepro/Program.cs

@@ -8,4 +8,4 @@ var config = new ConfigurationBuilder().AddInMemoryCollection(new Dictionary<str
 }).Build();
 var options = new OpcUaApplicationHostOptions();
 config.GetSection("OpcUa").Bind(options);
-Console.WriteLine(string.Join(", ", options.EnabledSecurityProfiles));
+Console.WriteLine(string.Join(", ", options.ResolveEnabledSecurityProfiles()));