Respond to OpenAPI security scheme extensions

See https://github.com/USACE/cwms-data-api/pull/1357 for current designs.

"OpenIDConnect": {
        "type": "openIdConnect",
        "scheme": "openid",
        "openIdConnectUrl": "http://localhost:8081/auth/realms/cwms/.well-known/openid-configuration",
        "x-kc_idp_hint": {
          "query-parameter": "kc_int_hint",
          "values": [
            "login.gov",
            "federation-eams"
          ]
        },
        "x-oidc-client-id": "cwms"
      }

Something to be aware of is that this data is in the OpenAPI Spec as it's site specific. More thought is required but I suspect this library should "except" these additional details, like allowing extra headers and the bulk processing work should be in hec-client-server as that gets the API URL and retrieves the above openIdCOnnectURL.... maybe it can just pass in all the extensions.... like I said, more thought and discussion required.

Start by reading PR 1357 for the current designs and reviewing how this client handles OpenAPI security schemes. Clarify whether site-specific extensions should be accepted, passed through to hec-client-server, or used for extra headers, then document the agreed behavior and add coverage for the chosen handling.