feat(acl): anonymous becomes a normal grantable principal (#520 D3)

Anonymous sessions used to short-circuit in HandleImpersonation — "let the SDK's
default validation stand" — so they always connected and always carried no roles.
Now admission and authority are separated:

  admission  -> OpcUa:AllowAnonymous, the HOST's decision (it owns token policies)
  authority  -> the authenticator, resolving the reserved principal "anonymous"
                through the SAME grant path a key's principal goes through

So anonymous can be granted WRITE, not merely tolerated as read-only, and it
arrives at the downstream gates as the same RoleCarryingUserIdentity a key
produces — which is the real payoff: no gate carries an anonymous-shaped branch,
so there is no bypass path to get wrong.

AllowAnonymous defaults to TRUE on purpose. Defaulting it false would silently
deny every client without a key the moment this deploys, including ScadaBridge's
Data Connection Layer in another repo. Making keys mandatory is a rollout
decision, not an upgrade side effect. When false, the Anonymous token policy is
withheld so a client is refused at DISCOVERY rather than only at activation, and
activation is rejected independently in case a client attempts a token type the
endpoint never advertised.

Two fail-closed choices, both falsified:
- A failure to read anonymous's grants DENIES rather than admitting with no
  roles. Admitting is the pre-#520 behaviour, and defaulting to it exactly when
  the server cannot determine what anonymous may do stops being harmless once
  reads are gated. Making it admit reds Anonymous_denies_when_grants_cannot_be_read.
- A key may not authenticate as the reserved "anonymous" principal, or a
  credentialled client silently inherits whatever anonymous was granted.

AuthenticateAnonymousAsync is a DEFAULT interface implementation returning
admit-with-no-roles, i.e. exactly the pre-#520 behaviour, so
NullOpcUaUserAuthenticator and every test double keep working rather than being
forced to reimplement it — important because driver-only nodes run the Null one
and would otherwise black out. Note a default interface method is only reachable
through the interface-typed reference, which is how OpcUaApplicationHost holds it.

An existing test asserted the old fall-through and correctly went red; it is
rewritten to pin the new contract rather than deleted, with the reason recorded.

OpcUaServer 366, Host 42 green.

Claude-Session: https://claude.ai/code/session_015p7wGqy3YpZNCpDzTpGMKo

src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/Security/IOpcUaUserAuthenticator.cs

@@ -22,6 +22,43 @@ public interface IOpcUaUserAuthenticator
     /// <param name="ct">The cancellation token.</param>
     /// <returns>An OpcUaUserAuthResult indicating success or failure.</returns>
     Task<OpcUaUserAuthResult> AuthenticateUserNameAsync(string username, string password, CancellationToken ct);
+
+    /// <summary>
+    ///     Resolves what an <b>anonymous</b> session is allowed to do (#520). Anonymous is a normal
+    ///     principal — <see cref="OpcUaPrincipals.Anonymous"/> — not a special case, so it can be granted
+    ///     read or write through ordinary ACL rows.
+    /// </summary>
+    /// <remarks>
+    ///     <para>
+    ///         This is asked only AFTER the host has decided anonymous sessions are admissible at all
+    ///         (<c>OpcUaApplicationHostOptions.AllowAnonymous</c>). Admission is the host's decision;
+    ///         authority is this seam's.
+    ///     </para>
+    ///     <para>
+    ///         The default implementation admits anonymous with <b>no roles</b>, which is exactly the
+    ///         behaviour before #520: an anonymous session connects, and every role-gated operation
+    ///         (write, alarm ack) denies. Implementors that can resolve grants override it; the rest
+    ///         keep the safe status quo rather than being forced to reimplement it.
+    ///     </para>
+    /// </remarks>
+    /// <param name="ct">The cancellation token.</param>
+    /// <returns>The roles to attach to the anonymous session, or a denial.</returns>
+    Task<OpcUaUserAuthResult> AuthenticateAnonymousAsync(CancellationToken ct) =>
+        Task.FromResult(OpcUaUserAuthResult.Allow(OpcUaPrincipals.Anonymous, Array.Empty<string>()));
+}
+
+/// <summary>Reserved principal names for the OPC UA data plane (#520).</summary>
+public static class OpcUaPrincipals
+{
+    /// <summary>
+    ///     The principal an anonymous session authenticates as. <c>NodeAcl</c> rows naming it grant
+    ///     anonymous clients permissions exactly as they would a key's principal.
+    /// </summary>
+    /// <remarks>
+    ///     Reserved: an API key must not be created with this principal, or a key would silently inherit
+    ///     whatever anonymous was granted (and vice versa). Enforced at authoring time.
+    /// </remarks>
+    public const string Anonymous = "anonymous";
 }
 
 /// <summary>Outcome of a UserName authentication attempt. <see cref="Roles"/> populates the session identity's role set.</summary>