Support deep traversal of schema in nested visitors

Is your feature request related to a problem? Please describe.
When you define a rule using nested visitor, for example, Response: { Schema: ... }, per documentaion:

It will be executed only for the first level of Schema Object.

Thus, if you want to check schema's properties and sub-properties, you have to do deep traversal manually.

Describe the solution you'd like
As I understand it, the main advantage of nested visitors is scoping. For example, when you want to lint schema properties only in response or request bodies, but not in parameters. Doing deep traversal manually isn't worth it, because there might be refs, allOf/oneOf/anyOf.
In comparison, when using Schema without nesting, the rule is checked against each individual property. It would be great to have the same behaviour in nested visitors too.

Describe alternatives you've considered
Currently we use non-nested Schema visitor. We tried two approaches to detect that schema comes from parameters:

• parent check: ctx.parent?.in → too naive and prone to false positives and negatives
• pointer check: /\/parameters\/\d+(?:(?:\/)|(?:\/.+\/))schema/.test(ctx.location.absolutePointer) → doesn't work with refs

In the end, right now we simply use ignore file.

Start by tracing the nested visitor and Schema visitor handling described in the issue, including how refs and allOf/oneOf/anyOf are traversed. Done means a nested Schema visitor reaches nested properties while remaining scoped to its request or response context, without requiring manual traversal.