Multiple security schemes in OpenAPI: AND vs OR, optional auth, and per-operation overrides

The security keyword is small and surprisingly easy to invert. It is an array of alternatives, where each alternative is itself a set of schemes that must all be satisfied. Miss the distinction betwee