Problem Definition:
With the introduction of "Secure by Default" in Bitbucket Data Center 10.0, new installations default to block-requests: true with an empty allowlist for Basic Authentication. While this improves security, it creates a circular dependency for automated, unattended provisioning:
1. Bitbucket is installed and booted automatically.
2. The provisioner attempts to configure the instance (licenses, mail, groups, etc.) via the REST API using the setup-seeded sysadmin credentials.
3. The REST API request is rejected because Basic Auth is blocked by default and the sysadmin is not yet allowlisted.
4. The allowlist can only be updated via REST, which is currently blocked.

Currently, the only workaround is to boot with the JVM flag -Dcom.atlassian.plugins.authentication.basic.auth.filter.force.allow=true, perform the REST calls, and then restart the instance without the flag. This adds significant overhead and an unnecessary restart cycle to automated deployments.

Suggested Solution:
Introduce support for configuring the Basic Auth allowlist during the initial boot process using standard configuration methods, similar to how setup.license and setup.sysadmin.* function.