Logical AND

Hi there!

Are the any plans to support Logical AND for OAuth2 authentication security schemes?
Based on this [documentation](https://cloud.google.com/endpoints/docs/openapi/openapi-limitations#security_requirements_for_oauth2) it seems that ESPv2 support security requirement conjunctions (logical AND) for API key and OAuth2 authentication, but not for two Oauth2.

Is there any way to enforce ESPv2 to validate a firestore token and a app check token?

Err I get:

`kind: ERROR
message: "security section contains multiple security definitions \'firebase_app_check,firebase\' within the scope (Security Requirement Object) that get logically ANDed (both requirements need to be satisfied to allow the request). We only support allowing logical OR between security definitions. Therefore, please write requirements in different objects inside the array (which would mean logical OR, that is, any of the requirement should be sufficient to allow the request.)"
`

Thank you

Start at ESPv2's OpenAPI security requirement handling, using the reported error for a request with firebase_app_check and firebase. Confirm how security requirement objects are interpreted, then define and verify behavior for conjunctions between two OAuth2 schemes, including the Firestore and App Check token case.

Written by the indexing model from the issue text.