should override global security on operation-level

**Actual behavior (the bug)**
Given a global security set, when you specify a specific securiy on an endpoint, then it is bypassed by the global security

**Expected behavior**
A security set on an endpoint should override the global security

**To Reproduce**
```
@Test
fun `should override global security on operation-level`() {
val json = builder()
.withGlobalSecurity("BearerAuth")
.apply {
path("/login").operation("post") {
security { }
}
}
.toJson()

assertThatJson(json).inPath("$.security").isArray.hasSize(1)
assertThatJson(json).inPath("$.paths['/login'].post.security").isArray.isEmpty()
}
```

**Additional context**
When I was using javalin5, i was able to do it.

Start with the Kotlin test shown in the issue and reproduce the generated JSON for a global BearerAuth security setting plus an empty operation-level security setting. Trace how the builder handles security for the global document and the `/login` POST operation. Done means the global security remains present while `$.paths['/login'].post.security` is an empty array and the test passes.

Written by the indexing model from the issue text.