Security: Make databases private by default

## Summary
Currently the config warns, that if no roles or members are configured, the database will be publicly accessible.

If you just PUT `{}` into `/_security`, the database will be public.
But in a database it should be very hard to release something to the public and data should be private by default.

The motivation behind this could be a scenario like this:
The database holds sensitive data, e.g. from health care. An issue comes up that requires immediate action, e.g. a leak in a client application which allows to get database account data. Now the admin currently on duty at 4am thinks:
"okay, if i just kick all roles with access from the db, I should be fine".

If you're doing everything right, your database remains private with the current implementation. Things don't always go right however and CouchDB should help the user here to avoid mistakes.

## Desired Behaviour

If there is no access configured, only admins should have access, not everyone.
If needed, a config option can be added, that imitates the old behavior. (This should NOT be the default)

## Possible Solution
I added a `andalso false` as POC in https://github.com/apache/couchdb/blob/0059b8f90e58e10b199a4b768a06a762d12a30d3/src/couch/src/couch_db.erl#L700

This worked in a simple test and denied access, when no roles or members were set, thus the false could be replaced with a config option. The config option should default to false and if true behaves like the current CouchDB.

Start at src/couch/src/couch_db.erl around line 700, where the reported proof of concept changes access when no roles or members are configured. Trace the existing database security behavior and configuration handling, then define and verify that unconfigured databases permit only admins while any compatibility option is explicitly opt-in.

Written by the indexing model from the issue text.