fix: harden ClientOverridePolicy defaults to prevent userVerification downgrade

Change default client override policy for user_verification to deny
overrides by default and exclude 'discouraged' from allowed values.
This prevents a client from downgrading userVerification to bypass
biometric/PIN requirements configured server-side.

- ClientOverridePolicy::canOverride() now defaults to false for unknown fields
- user_verification.enabled defaults to false (was true)
- user_verification.allowed_values defaults to ['required', 'preferred'] (was ['required', 'preferred', 'discouraged'])

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Spomky

src/symfony/src/DependencyInjection/Configuration.php

@@ -150,11 +150,11 @@ private function addClientOverridePolicyConfig(ArrayNodeDefinition $rootNode): v
             ->addDefaultsIfNotSet()
             ->children()
             ->booleanNode('enabled')
-            ->defaultTrue()
+            ->defaultFalse()
             ->info('Whether to allow client requests to override the user verification requirement')
             ->end()
             ->arrayNode('allowed_values')
-            ->defaultValue(['required', 'preferred', 'discouraged'])
+            ->defaultValue(['required', 'preferred'])
             ->scalarPrototype()
             ->end()
             ->info('List of allowed values for user verification requirement')

src/symfony/src/Policy/ClientOverridePolicy.php

@@ -27,7 +27,7 @@ public function __construct(
      */
     public function canOverride(string $field): bool
     {
-        return $this->policies[$field]['enabled'] ?? true;
+        return $this->policies[$field]['enabled'] ?? false;
     }
 
     /**