Fix explicit empty OIDC allowlist persistence

[chen21019]

Root cause

The policy path allowed an empty allowlist, but serialized the setting update through the generated Setting.Value field whose omitempty tag removed value from the HTTP payload. The platform therefore kept the prior restricted allowlist even after access mode became unrestricted. The existing fake platform decoded a missing field as the empty-string zero value, so the regression test could not distinguish omission from an explicit clear.

Fix

• Send common setting updates as an explicit wire map so an empty value is preserved.
• Make the policy test reject an update that omits the string value field.
• Document the exact compatibility contract.
• Bump reviewed release references to v0.4.39.

Verification

The branch security release gate builds and tests twice, compares deterministic packages, emits CycloneDX evidence, scans source, product, and build image, and blocks applicable Critical or High findings and secrets. After the immutable release, the integrated Authentik QA policy lifecycle will be rerun through the public Server API and database readback.