user.role.anonymous.yml exports, but does not install

This project has saved us a lot of time, so THANKS!

Problem/Motivation

We've just run into one issue. I'm not sure it's even an issue as much as something that just needs some documentation or a UI improvement.

We are using the https://git.drupalcode.org/project/paragraphs/-/tree/8.x-1.x/modules/par.... With that module enabled, permission to view each type of paragraph had to be explicitly granted to the anonymous role. This was reflected in the user.role.anonymous.yml, but unlike all other user.role permission exports, the anonymous role permissions were never set after installing the profile.

I think I'm running into the same thing https://drupal.stackexchange.com/questions/244371/how-to-disable-anonymo... was seeing. No idea why that question was down voted, but

Steps to reproduce

1. Set a permission you'd like the anonymous role to have when your profile is installed
2. With this module enabled, run `drush cex`
3. confirm that user.role.anonymous.yml is added to the profile/config/install
4. rerun the profile install (you may have to delete the root, project level version of the config

The expectation is that the anonymous role will have the permissions you specified, but it won't.

Proposed resolution

The solution I'm using is to set the anonymous permissions in the profile's .install with something like...

$anon_perms = [
    'access content',
    'view media',
    'view paragraph content content_accordion',
    'view paragraph content content_accordion_item',
    'view paragraph content content_anchor_link',
    'view paragraph content content_card',
    'view paragraph content content_horizontal_rule',
    'view paragraph content content_list',
    'view paragraph content content_list_item',
    'view paragraph content content_list_styled_order',
    'view paragraph content content_list_styled_order_item',
    'view paragraph content content_media',
    'view paragraph content content_quote',
    'view paragraph content content_wysiwyg',
    'view paragraph content cuskt_content_library_reference',
    'view paragraph content cuskt_layout',
    'view paragraph content cuskt_layout_hero',
    'view paragraph content hero_wysiwyg',
    'view paragraph content view_reference',
  ];
  user_role_grant_permissions(RoleInterface::ANONYMOUS_ID, $anon_perms);

User interface changes

I don't think it's actually possible to make core apply the user.role.anonymous.yml permission during the profile install, but it would be helpful if the UI indicated that wasn't going to work. Just setting that as the default value of blacklist with a field description explaining that the user.role.anonymous.yml can't be used during the install?

I might create an MR for this, but I also just wanted to document the issue in case someone else runs into it in the future.