Fix bearer-only security builds and bearer scheme name mapping

[davidkallesen]

Summary

• Make specs with a bearer scheme but no roles/policies/scopes compile
• Stop OPR022 flagging 403 on authenticated operations
• Map http bearer schemes to the registered "Bearer" auth scheme
• Cover the unified MinimalApi surface by compilation and at runtime

Changes

🐛 Fixes

• Always generate AddApiSecurityPolicies() when a scheme exists
• Register AddAuthorization() when there are no policies to add
• Prevent startup failure from UseAuthorization() without services
• Report OPR022 only when an operation has no security requirement
• Keep OPR022 for operations opting out with "security: []"
• Align OPR022 descriptor title and docs with the new meaning

✨ Features

• Map "type: http, scheme: bearer" to the "Bearer" scheme name
• Add x-authentication-scheme extension to override the mapped name
• Keep the securityScheme key for apiKey, oauth2 and other types

💥 Breaking Changes

• Endpoints now require "Bearer" instead of the bearer scheme key

♻️ Refactoring

• Move Showcase and MultipartDemo hosts to default AddJwtBearer()

🔧 Configuration

• Reference Atc.Rest.MinimalApi in the source generator test project
• Hide it from scenarios unless a MinimalApi mode is "Enabled"

✅ Tests

• Add SecurityBearerOnly scenario to the compilation gate
• Host generated bearer-only code on Kestrel: 401 and 200 paths
• Add extractor contract tests for security DI generation
• Add validator tests for OPR022 on secured and anonymous operations
• Add scheme name mapping tests, including the extension override
• Update SecurityStandard baselines for the "Bearer" scheme name

Breaking Changes

• Bearer endpoints now call AddAuthenticationSchemes("Bearer")
• Previously they used the securityScheme key, e.g. "bearer_auth"
• Hosts using AddJwtBearer("") will fail every request
• Fix: switch to the default AddJwtBearer(...) registration
• Or: add x-authentication-scheme: to the securityScheme