[hdamker]

What type of PR is this?

• enhancement/feature

What this PR does / why we need it:

Adds three Spectral rules to the r4 ruleset that check the security scheme itself. Until now an API definition that referenced an undefined openId scheme, or defined openId as type: oauth2, passed validation with no finding, because the built-in oas3-operation-security-defined is disabled (it requires scopes under flows, which an openIdConnect scheme does not have) and the OWASP rules only check that a security entry exists.

• S-041 camara-security-requirement-defined (error): every name in a security requirement at root, operation and callback level must exist in components.securitySchemes.
• S-042 camara-security-openid-scheme (error): a secured API must define openId with type: openIdConnect; a scheme of type: oauth2 under any name is reported too.
• S-043 camara-security-openid-url (warn): openIdConnectUrl must use HTTPS and end in /.well-known/openid-configuration.

The rules run on the resolved document, so a scheme given as $ref to CAMARA_common.yaml is checked through its target. One FAQ entry covers all three rules. The r3.4 ruleset is unchanged.

Which issue(s) this PR fixes:

Fixes #522

Special notes for reviewers:

A sweep over the current main of all API repositories hits only NetworkInsights (S-041, S-042), IoTSIMFraudPrevention (S-042) and three sandbox repositories without a public release (S-042). All other repositories, including every latest public release, stay clean. The regression fixture branch regression/r4.3-broken-spec-security-scheme is captured after merge; the tested_rules entries and the theme row already point at it.

Changelog input

 release-note
 Added security scheme rules S-041 (undefined security requirement name), S-042 (openId must be an openIdConnect scheme) and S-043 (openIdConnectUrl form) to the r4 ruleset.

Additional documentation

docs
 documentation/validation/faq.md#s-041-security-scheme

[rartych]

LGTM