Security on nested routers

Reading the Swagger [Bearer Authentication](https://swagger.io/docs/specification/authentication/bearer-authentication/) documentation, it is possible to add security globally, or on a specific route or routes *(**e.g.** in the `/private` routes in the below screenshot.)*

This doesn't appear to apply to a nested router such as the ***Secure*** section below. This nested router includes the `security` configuration as part of the `schema` but is seemingly ignored as no lock appears on the route, nor is `security` listed in the `openapi.json` for those routes *(unlike the `/private` routes.)*

Is *(the inability of)* applying security to all routes inside a nested router a limitation of `itty-router-openapi`, OpenAPI itself, or am I perhaps going about this the wrong way?

Repository: https://github.com/jasiqli/itty-openapi-security-test


Start with the linked itty-openapi-security-test reproduction and inspect how the nested Secure router defines its schema and security configuration. Compare its generated openapi.json and Swagger display with the /private routes; done means determining whether nested-router security is supported and documenting or correcting the observed behavior.

Written by the indexing model from the issue text.