fix: honor inherited OpenAPI security

[cloudcarver]

Summary

• apply top-level OpenAPI security when an operation omits its own security field
• preserve explicit empty operation security as an anonymous override
• normalize inherited schemes, scopes, and anonymous alternatives deterministically
• add generated Fiber behavior tests for protected and public routes

Validation

• go test ./...
• go test -race ./pkg/codegen/oapi
• go vet ./...

Closes #37