#169 - Allow to disable the security configuration overriding the application main firewall

[njoubert-cleverage]

Description

Fixes #169.

• New clever_age_ui_process.security.configure_firewall option, default true (same behaviour as before). The bundle adds its security configuration with loadFromExtension(), after the application one, so it overrides the provider, form_login and logout of the application main firewall. With false, no security configuration is added (neither the process_user_provider user provider, which would also require an explicit provider on every application firewall, nor the firewall): the application configures them, e.g. on a firewall dedicated to the UI.
  The option is read in prepend(), before the bundle configuration is processed: it must be a literal boolean, a parameter or an environment variable fails with an explicit message.
• monolog, doctrine_migrations and security configurations are skipped when the bundle is not enabled (instead of the LogicException of getExtension()).
• Docs: these configurations are added after the application one (only the Messenger one is prepended); new "Configuring the security in your application" section.

prependExtensionConfig() was not used for security: the application values would then win, which breaks the applications relying on the current behaviour (e.g. the default Symfony recipe with provider: users_in_memory on main, as in the demo). To be reconsidered for 4.0.

Checked in process-bundle-demo:

• default: debug:config security firewalls.main gives provider: process_user_provider, login and dashboard OK (unchanged);
• configure_firewall: false with the dedicated process firewall of the documentation: main keeps provider: users_in_memory; /process redirects to the login, login → dashboard (200), API with a wrong token → 401, logout → login.

Requirements

• Documentation updates
  • Reference
  • Cookbooks
  • Changelog
• Unit tests

Breaking changes

None: new option whose default keeps the current behaviour; the configurations skipped when their bundle is not enabled made the container fail before.

🤖 Generated with Claude Code