Bugfix
The changes in #28280 mean that the ElementBoundHelper now returns an AbstractBoundWrapper as the securityRoot instead of an AttributedStructuredElementWrapper. However, the implementation of the getSecurityParent() function is different there. While the StructuredElementWrapper always returns null, the configuration "use-default-security-parent" applies in the AbstractBoundWrapper. If this is configured to true for the application, the root element returns itself as a parent, which leads to an infinite loop in the com.top_logic.tool.boundsec.wrap.BoundedRole.addRoles(Set<BoundRole>, TLObject, Group) method.