Add class allow-list migration controls (cherry-pick #4888)

[nvidianz]

Description

Cherry-pick of #4888 (merged to 2.8 as c3daf63) onto main, bringing the class allow-list migration controls forward:

• support "*" in class_allow_list to allow all component classes, ignore remaining entries, and record an audit event
• add class_list_enforcement_mode with enforce (default) and warn behavior
• include the enforcement mode in provisioned client and server resource templates
• use the curated built-in default allow list (with an audit event) when a site does not configure class_allow_list
• unit coverage for wildcard, warn/enforce modes, site configuration filtering, and provisioning defaults

Conflict resolutions vs main (which had diverged via #4841):

• master_template.yml: kept main's {~~class_allow_list~~} placeholder (filled from DEFAULT_CLASS_ALLOW_LIST by the static file builder) and added only the new class_list_enforcement_mode line to both client and server resource blocks
• default_component_policy.py: kept main's copy (identical list); updated its docstring since the authorizer now does use it as the implicit default
• static_file_builder_test.py: kept main's DEFAULT_CLASS_ALLOW_LIST-based assertion instead of the PR's inline list; the new enforcement-mode assertion is included
• unsafe_component_detection.rst: adopted the PR's default-with-audit semantics, keeping main's provisioning and SimEnv sentences

Note: this intentionally changes main's #4841 behavior for unconfigured sites from "fail with an explicit setup error" to "use the curated built-in default and record an audit event", matching 2.8. Main's no-fallback tests were superseded by the PR's test_uses_default_allow_list_* tests.

Types of changes

• Non-breaking change (fix or new feature that would not break existing functionality).
• Breaking change (fix or new feature that would cause existing functionality to change).
• New tests added to cover the changes.
• Quick tests passed locally by running ./runtest.sh.
• In-line docstrings updated.
• Documentation updated.

Validation: 155 passed, 1 skipped across all unit suites referencing the policy/authorizer; flake8 and black clean on changed files.

[greptile-apps]

Greptile Summary

This PR adds migration controls for component class allow-listing. The main changes are:

• Built-in default allow-list fallback for unconfigured sites.
• Wildcard support for explicitly allowing all component classes.
• enforce and warn modes for class-list authorization.
• Audit and warning records for default, wildcard, and warn-mode decisions.
• Provisioning, site-config filtering, docs, release notes, and unit coverage.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
nvflare/app_common/widgets/component_path_authorizer.py	Adds default policy fallback, wildcard handling, warn/enforce behavior, audit logging, and stricter component path validation.
nvflare/lighter/templates/master_template.yml	Adds explicit class-list enforcement mode to provisioned client and server resource templates.
nvflare/private/fed/utils/site_config.py	Excludes the class-list enforcement mode from shared site configuration output.
docs/user_guide/admin_guide/security/unsafe_component_detection.rst	Updates the admin guide for default allow-list behavior, warn mode, wildcard behavior, and audit records.
docs/release_notes/flare_280.rst	Adds migration guidance for default allow-listing, warn mode, wildcard mode, and locked-down production policy.
tests/unit_test/app_common/widgets/component_path_authorizer_test.py	Adds coverage for default policy fallback, wildcard behavior, warn/enforce behavior, audit behavior, and validation.

_{Reviews (3): Last reviewed commit: "Merge branch 'main' into main-class-allo..." | Re-trigger Greptile}

[codecov-commenter]

Codecov Report

❌ Patch coverage is 96.45390% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 61.78%. Comparing base (b1b06ad) to head (8a3f7d4).

Files with missing lines	Patch %	Lines
...re/app_common/widgets/component_path_authorizer.py	96.45%	5 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4905      +/-   ##
==========================================
+ Coverage   61.72%   61.78%   +0.05%     
==========================================
  Files         985      985              
  Lines       95681    95805     +124     
==========================================
+ Hits        59062    59196     +134     
+ Misses      36619    36609      -10     

Flag	Coverage Δ
unit-tests	61.78% <96.45%> (+0.05%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.