Authenticated policy bypass via stale client-state evaluation

Authorization bypass in Red Hat build of Keycloak allows remote authenticated users to persist noncompliant confidential clients. The client-policy access-type condition evaluates the existing client state rather than the proposed state during an update, so a public client can become confidential without triggering its policy profile. Client-management permission or a valid dynamic registration token is required; the result is weaker client authentication than realm policy permits.