Add a toggle to keep using 2.x default behavior of allowing access for roles

+1. I've patched for now with

diff --git a/vapn.module b/vapn.module
index ffcc861..35bb5ce 100644
--- a/vapn.module
+++ b/vapn.module
@@ -70,6 +70,12 @@ function vapn_node_access(NodeInterface $entity, $operation, AccountInterface $a
       $rid = $item->target_id;
       $allowed_roles[$rid] = $rid;
     }
+
+    // Nothing marked on a node? Allow by default.
+    if (empty($allowed_roles)) {
+      return AccessResult::neutral();
+    }
+
     $access_result = array_intersect($account->getRoles(), $allowed_roles)
       ? AccessResult::allowed()
       : AccessResult::forbidden();

but that if could be controlled by a settings flag.

Here is the patсh with changes from #2.
But I agreed we need to add some toggle in module settings.

+1 to make this configurable.

The change make sense (security, and thus access denied, by default etc), but if you have many nodes of certain type and only a few with restrictions, this change has enormous impact.
The update hook vapn_update_9000 doesn't seem to take nodes without vapn restrictions into account.