Access Control: an empty $allowed_actions does not disable "index"

The Controllers "Access Control" page says (branches 5 and 6, en/02_Developer_Guides/02_Controllers/03_Access_Control.md, line 73):

An action named "index" is allowed by default, unless allowed_actions is defined as an empty array, or the action is specifically restricted.

Unless I'm misreading it, the framework does not behave that way. RequestHandler::checkAccessAction() allows index whenever it is not explicitly listed (if (!$isDefined && ($action == 'index' || empty($action))), framework 5 line 498, framework 6 line 505), and ControllerTest asserts exactly this: "Access granted on index with empty $allowed_actions on defining controller".

So with private static $allowed_actions = []; the index action is still reachable. Perhaps the sentence could say that index stays allowed unless it is restricted explicitly (for example 'index' => 'ADMIN' or 'index' => false)? Happy to open a PR if that wording is right.

Start with en/02_Developer_Guides/02_Controllers/03_Access_Control.md at line 73, then compare the wording with RequestHandler::checkAccessAction() and the ControllerTest assertion mentioned in the issue. Done means the documentation accurately explains index access with an empty allowed_actions array and the explicit restrictions that prevent it.