test: cover optional operation security alternatives

[kriptoburak]

Summary

Adds a focused OpenAPI 3.1 regression case for operation-level security alternatives that include:

• API key auth
• bearer auth
• an empty security requirement object for anonymous access

This is valid OpenAPI behavior and is already accepted by the rule. The new case keeps that behavior covered directly.

Validation

• git diff --check
• Targeted Jest was not run locally because the repo dependency install hit local disk exhaustion while populating the Yarn cache.