Add first-class Bearer security

Goa can already generate support for HTTP `Authorization: Bearer `, but today that support is only available through `JWTSecurity`. This makes it awkward to model APIs that accept opaque Bearer tokens. These APIs are not JWT-specific, but their Goa designs still need to use JWT terminology in the DSL and the generated auth hooks. As a result, the implementation ends up exposing JWT-specific names even when the public OpenAPI contract is just standard HTTP Bearer authentication.

It would be useful to have a `BearerSecurity` DSL for modeling generic Bearer authentication without JWT-specific terminology. Ideally, this would also include matching Bearer token payload helpers.

For OpenAPI v3, `BearerSecurity` should generate:

- `type: http`
- `scheme: bearer`
- `bearerFormat` only when the design explicitly sets one

`BearerSecurity` and `JWTSecurity` could share the same default HTTP wire format:

`Authorization: Bearer `

The main difference would be semantic and reflected in the generated names. `BearerSecurity` would generate Bearer-oriented hooks for generic or opaque Bearer tokens, while `JWTSecurity` would continue to generate JWT-oriented hooks for designs that explicitly model JWT Bearer tokens.