The Scan Enabled checkbox of the Security Vulnerabilities administration is checked when no value is saved, even if the scan is disabled in xwiki.properties

Steps to reproduce

1. In xwiki.properties, set extension.security.scan.enabled = false and restart XWiki.
2. Do not save anything in the "Security Vulnerabilities" section of the global administration.
3. Open that administration section.

Expected result

The "Scan Enabled" checkbox shows the value that is actually used, so it is unchecked.

Actual result

The "Scan Enabled" checkbox is checked, but the scan is disabled: the log shows Extension security scan disabled. at every scheduled run.

Cause

The configuration only reads the scanEnabled property of XWiki.Extension.Security.Code.Config when a value is saved for it, and falls back to extension.security.scan.enabled from xwiki.properties otherwise. This matches the documentation ("When a value is not filled in the administration UI, the corresponding xwiki.properties value is used"). However, the scanEnabled field is created with a default value of true (in ConfigClassMandatoryInitializer), so when nothing is saved the form displays the field default, not the value in use.

Another consequence: once the section is saved, a checkbox always stores 1 or 0 and can never be "not filled" again. From then on, the xwiki.properties value is ignored with no way to go back from the UI.

Possible fixes: display the effective value when nothing is saved, or use a select with an explicit "default (from xwiki.properties)" option, so that falling back to xwiki.properties can still be expressed from the UI.

Reported on the forum: https://forum.xwiki.org/t/on-extension-security-scan-enabled/18909