Use inclusive terminology in docs (blacklist/whitelist -> denylist/allowlist) - #51453

docs/documentation/server_admin/topics/authentication/password-policies.adoc:142

• The nested CLI instruction on line 144 still says “blacklist folder.” That phrase is user-facing prose rather than an immutable identifier, so leaving it unchanged makes this terminology update incomplete.

* Denylist files resolve against `+${kc.home.dir}/data/password-blacklists/+` by default. Customize this path using:

docs/guides/securing-apps/client-registration.adoc:228

• This still describes the defaults inaccurately: allow-default-scopes defaults to true and permits both realm default and realm optional client scopes (see ClientScopesClientRegistrationPolicy.java:128-132). Distinguish the empty explicit allowlist from the scopes that are implicitly allowed.

There are no allowlisted scopes by default; only the client scopes, which are defined as `Realm Default Client Scopes` are allowlisted by default.

docs/documentation/server_admin/topics/authentication/password-policies.adoc:144

• The sample value blacklistsFolder is not a compatibility-sensitive identifier, so it unnecessarily retains the excluded terminology despite this PR's stated documentation update. Rename only this arbitrary path value while preserving the real property and CLI flag names.

** The `blacklistsPath` property of the `passwordBlacklist` policy SPI configuration. To configure the denylist folder using the CLI, use `+--spi-password-policy--password-blacklist--blacklists-path=/path/to/blacklistsFolder+`.

docs/guides/securing-apps/client-registration.adoc:214

• Line 214 lost the indentation it previously had as a wrapped continuation line. In AsciiDoc lists, wrapped lines are typically indented to remain part of the list item; without indentation, rendering can change (e.g., splitting into a separate paragraph). Restore the prior indentation for this wrapped line to keep list formatting consistent.

* Trusted Hosts Policy - You can configure list of trusted hosts and trusted domains. Request to Client Registration Service can be sent just from those hosts or domains.
Request sent from some untrusted IP will be rejected. URLs of newly registered client must also use just those trusted hosts or domains. For example it won't be allowed
to set `Redirect URI` of client pointing to some untrusted host. By default, there is not any allowlisted host, so anonymous client registration is de-facto disabled.

docs/documentation/server_admin/topics/authentication/password-policies.adoc:151

• Hyphenate the compound modifier: change 'memory efficient' to 'memory-efficient'.

The current implementation uses a BloomFilter for fast and memory efficient containment checks, such as whether a given password is contained in a denylist, with the possibility for false positives.