Explicitness about Yubi authn handler open-by-default behavior

...y

Renamed default Yubikey account registry to reflect its accept-any behavior.  It ain't got no whitelist -- it ain't got no kind of list at all.

Added more explicit JavaDoc about how completely not okay it is to accept that default in production.

Added warning log message on class instantiation with unsafe default config.

Concerned these changes don't go far enough and this authentication handler should "fail closed" rather than "failing open" in the case where the adopter does not configure a yubikey registry.