Feat/openapi security spec

[snow-ghost]

Summary

This PR adds spec-driven security handling to ocli and updates the README
to describe the new user-facing authentication capabilities.

What changed

Spec-driven security support

• Added support for declared apiKey security schemes in header, query, and
  cookie
• Added support for root-level and operation-level security requirements
• Added support for alternative security requirement sets and automatic
  selection of the first satisfiable option
• Added profile-level auth-values storage for named security schemes

Profile storage updates

• Extended profile persistence to store and load auth_values
• Added CLI support for passing auth values during onboarding

User impact

Users can now work with APIs that declare API key authentication directly in
the OpenAPI / Swagger spec.

This means:

• API keys can be injected into the correct request location automatically
• users no longer need to manually rewrite request URLs for query-based keys
• cookie-based and header-based API key schemes can be driven from the spec
• operations with multiple security alternatives can use the first available
  credential set from the profile

Documentation

README was updated with a new user-facing section describing:

• declared apiKey security schemes
• root-level and operation-level security handling
• alternative security requirements
• auth-values for named security schemes