3.0.1 — Fail-closed access checks (security patch)

A small but important security patch. No API changes — drop-in over 3.0.0.

Fixed: access checks now fail closed

A resource marked securedResource = true that had no allowed roles (neither allowedRoles on @DynTab/@AccessCheck, nor a runtime grantAccess(...)) was previously granted to everyone — a resource you forgot to configure was wide open.

As of 3.0.1 that case is denied (fail-closed) and logged loudly:

Resource X is secured but has no allowed roles defined — DENYING access (fail-closed).

If this affects you: declare the roles that should have access — @DynTab(allowedRoles = {"ADMIN", ...}) / @accesscheck(allowedRoles = ...), or InMemoryAccessCheckInterceptor.grantAccess(resource, "ROLE")` at startup.
A secured-but-unconfigured resource is a mistake; the safe default is to deny.

Recommended: source roles from the platform

The demo now shows how to read the caller's roles straight from Jakarta Security (ExternalContext.isUserInRole) by overriding getUserRoles(), instead of copying them into a session attribute — one source of truth.

Full regression coverage (InMemoryAccessCheckInterceptorTest); suite green.