[PP-1] Don't allow all media types if no target bundle is configured

While reviewing #3033653: InvalidArgumentException when adding reference field without Media type, I discovered MediaLibraryWidget has:

  protected function getAllowedMediaTypeIdsSorted() {
    // Get the configured media types from the field storage.
    $handler_settings = $this->getFieldSetting('handler_settings');
    $allowed_media_type_ids = !empty($handler_settings['target_bundles']) ? $handler_settings['target_bundles'] : [];

    // When no target bundles are configured for the field, all are allowed.
    if (!$allowed_media_type_ids) {
      $allowed_media_type_ids = $this->entityTypeManager->getStorage('media_type')->getQuery()->execute();
    }

While I'm quite in favor of allowing all eligible bundles if no particular target bundle has been configured, this seems like a major inconsistency with how all other Core widgets handle this.

Generically, this has already been raised in #2348615: Clean up entity reference field settings anomalies (OP remark 3). Might this even be a regression?

IMO, we should generally allow all eligible bundles in this case, yet advertising this behaviour on the bundle settings ("If no target bundle is selected, all will be allowed" or so).

As pointed out in #2, this has been an explicit design decision based on perfectly reasonable security considerations.
So the inconsistency between MediaLibraryWidget and all others must be solved the other way around: if no media type has been explicitly allowed as target bundle, none is allowed, as is the case with all other Core widgets.
As a security-related bug, this is major and needs to be backported to D8.6.