Add a toggle to keep using 2.x default behavior of allowing access for roles

+1. I've patched for now with

diff --git a/vapn.module b/vapn.module
index ffcc861..35bb5ce 100644
--- a/vapn.module
+++ b/vapn.module
@@ -70,6 +70,12 @@ function vapn_node_access(NodeInterface $entity, $operation, AccountInterface $a
       $rid = $item->target_id;
       $allowed_roles[$rid] = $rid;
     }
+
+    // Nothing marked on a node? Allow by default.
+    if (empty($allowed_roles)) {
+      return AccessResult::neutral();
+    }
+
     $access_result = array_intersect($account->getRoles(), $allowed_roles)
       ? AccessResult::allowed()
       : AccessResult::forbidden();

but that if could be controlled by a settings flag.

Here is the patсh with changes from #2.
But I agreed we need to add some toggle in module settings.

+1 to make this configurable.

The change make sense (security, and thus access denied, by default etc), but if you have many nodes of certain type and only a few with restrictions, this change has enormous impact.
The update hook vapn_update_9000 doesn't seem to take nodes without vapn restrictions into account.

As someone who's site is thousands of open resources to <20 restricted, thank you. The change would have made this module unusable.

I have been keen to have a settings option to restore this behaviour, so I thought I would go ahead and build it myself.

Please review my changes. Make sure that:

• By default (e.g. on initial install) the 3.x behaviour occurs and the new settings option is not selected
• When the 2.x option is selected, nodes with no VAPN option selected can be viewed by any user. Nodes with specific user roles selected can only be seen by those users

I have included the patch file for anyone that needs it

• Renamed the option to a more generic and clear name, making it easier to understand for new users unfamiliar with version 2.x.
• Improved caching behavior for access check results.
• Added a test that covers the new mode of operation.