security things

[karenetheridge]

document validation:

• security requirements in an operation must correspond to security schemes defined in /components

runtime validation:

• minimal implementation: we can at least check if a security requirement is declared for an operation, and bomb out with the appropriate 40x error if the query/header/cookie is missing.

• provide some sort of hook where the caller can provide an implementation for performing authentication/authorization of a request or response: provide the request/response and the relevant bits of the OpenAPI object parsed into a sensible format, etc. TBD pending discussion with users.