test: cover optional operation security

[kriptoburak]

Summary

• Adds coverage for operation-level security alternatives that include an empty requirement.
• Verifies the operation security rule does not report the optional anonymous alternative as an undefined scheme.

Validation

• go test ./functions/openapi -run TestOperationSecurityDefined

[kriptoburak]

The build passes on the current head. The remaining label-check requires one of release/patch, release/minor, release/major, bugfix, or feature. This test-only regression coverage fits release/patch, but GitHub does not grant the PR author permission to apply repository labels. Please add release/patch to clear the final target-side gate.