Change the default value of fullScopeAllowed to false

[FlxPeters]

This discussion is a follow-up to the Keycloak DevDays 2025.
We had a great talk about security, and every speaker advised the audience to disable the "fullScopeAllowed" flag in clients.

As a result of the discussion, we concluded that Keycloak should support security by default and that the flag should be set to false by default.

The question is: Why is it set to true today, and what would be the consequences of changing it?

[FlxPeters]

@TmmmmmR was one of the speakers. @sventorben the other one.
Would be nice to hear your thoughts on that topic.

[sventorben]

This would be a breaking change, but from a security point of view I strongly support switching it off by default.

[FlxPeters]

I posted the discussion in the wrong repository. Sorry for that, there is a new one in the main repo: keycloak/keycloak#37927