fix(security): an app-declared baseline composes with the platform member_default instead of replacing it (#7555)

fix(security): an app-declared baseline composes with the platform member_default instead of replacing it (#7555) #3209