Operation-level `security: []` doesn't remove the root-level security, but instead inherits it

### Behavior

For this description:

```yaml
openapi: 3.0.3
info:
title: Order management
version: "1.0"
security:
- apiKeyAuth: []
paths:
/status:
get:
operationId: getStatus
tags: [Status]
security: []
responses:
200:
description: Service status, public by design
components:
securitySchemes:
apiKeyAuth:
type: apiKey
name: X-Api-Key
in: header
```

generating a server with `authImplementation = Simple` (or `Custom`) produces an authenticated handler:

```scala
trait StatusHandler[F[_], AuthContext] { def getStatus(respond: StatusResource.GetStatusResponse.type)(authContext: AuthContext): F[StatusResource.GetStatusResponse] }
```

However, following the spec, operation-level `security` should override the top-level declaration. And moreover, `security: []` should remove the security declaration, as [per spec](https://swagger.io/specification/v3.2/):

> To remove a top-level security declaration, an empty array can be used.

### Version

Reproduces on `v1.0.0-M1` (and current `master`), observed through `scala-http4s` generator for both v0.22 and v0.23. Luckily, this isn't reproducible for akka-http (because it doesn't seem to support auth generally).

Reproduce the issue with the provided OpenAPI YAML through the scala-http4s generator using authImplementation=Simple or Custom, then inspect the generated StatusHandler. Compare the handling of root-level and operation-level security and add a regression test showing that security: [] produces an unauthenticated operation handler.

Written by the indexing model from the issue text.