[PHP, possibly others too] securityDefinitions not working with $ref to other file

Description

If you generate PHP code (perhaps this also affects other languages, I haven't been able to check), when you add a securityDefinitions that has a $ref pointer to a different file the security headers are ignored.

Swagger-codegen version

Using 2.3.0 and the latest snapshot swagger-codegen-cli-2.3.1-20180111.084841-12.jar.

Swagger declaration file content or url

First file: test-endpoint.yaml

---
swagger: '2.0'

info:
  description: Test
  version: '1.0'
  title: Test

schemes:
  - https

securityDefinitions:
  $ref: './test-security.yaml#/securityDefinitions'

security:
  - Bearer: []

paths:

  /test:
    get:
      responses:
        204:
          description: 'Success'

Second file: test-security.yaml

securityDefinitions:
  Bearer:
    type: apiKey
    name: Authorization
    in: header

Command line used for generation

swagger-codegen generate -i test-endpoint.yaml -l php

Steps to reproduce

In the generated class DefaultApi I expect to find in the function testGetRequest the following lines of code (right before where the default header User-Agent is set):

        // this endpoint requires API key authentication
        $apiKey = $this->config->getApiKeyWithPrefix('Authorization');
        if ($apiKey !== null) {
            $headers['Authorization'] = $apiKey;
        }

Those are missing though. If in test-endpoint.yaml you replace

securityDefinitions:
  $ref: './test-security.yaml#/securityDefinitions'

with

securityDefinitions:
  Bearer:
    type: apiKey
    name: Authorization
    in: header

the code is correctly generated including the above code for setting the Authorization header. As mentioned before I was unable to verify whether this is an issue specific to PHP, or Codegen in general.

Suggest a fix/enhancement

Unfortunately I don't know what could cause this issue. I do know the support for references to other files is new in 2.3.0, it didn't work at all in older versions. Other references do work, so far it only seems to break for the securityDefinitions.

Start with the two reproducer files, test-endpoint.yaml and test-security.yaml, then run swagger-codegen generate -i test-endpoint.yaml -l php. Inspect how the external $ref under securityDefinitions is resolved and how the generated DefaultApi::testGetRequest handles security. Done means the generated PHP client includes the Authorization header logic for the referenced Bearer definition.