Root-level `security` isn't applied to operations without their own `security` key

### Behavior

For this description:

```yaml
openapi: 3.0.3
info:
title: Order management
version: "1.0"
security:
- apiKeyAuth: []
paths:
/orders:
get:
operationId: listOrders
tags: [Orders]
responses:
200:
description: The orders visible to the caller
components:
securitySchemes:
apiKeyAuth:
type: apiKey
name: X-Api-Key
in: header
```

generating a server with `authImplementation = Simple` (or `Custom`) produces an unauthenticated handler:

```scala
trait OrdersHandler[F[_]] { def listOrders(respond: OrdersResource.ListOrdersResponse.type)(): F[OrdersResource.ListOrdersResponse] }
```

However, following the spec, it's expected that root-level `security` will be applied to operations without their own `security` key.

### Version

Reproduces on `v1.0.0-M1` (and current `master`), observed through `scala-http4s` generator for both v0.22 and v0.23. Although, `scala-akka-http` appears to not support auth thing at all (so, perhaps, it's a different story), it also reproduces there.

Happy to contribute a fix if there's interest in accepting this contribution.

Start with security handling in the Scala HTTP4s generator, focusing on authImplementation values Simple and Custom and how operations without their own security key are processed. Reproduce the issue with the OpenAPI description from the report, then verify that the generated listOrders handler applies the root-level apiKeyAuth security requirement.

Written by the indexing model from the issue text.