Improvement: Add securitySchemes and per-operation security declarations to management OpenAPI spec

Summary

The gateway/gateway-controller/api/management-openapi.yaml currently omits components.securitySchemes and per-operation security declarations across all protected endpoints (Rest API, WebSub, LLM Provider, LLM Proxy, Certificates, Secrets Management, etc.). This means the OpenAPI contract does not specify how clients must authenticate, even though endpoints advertise 401 Unauthorized responses.

Problem

• No components.securitySchemes entry is defined anywhere in the spec.
• No security requirement is attached to any operation that returns 401.
• Clients cannot determine the authentication mechanism from the spec alone.

Proposed Improvement

1. Define a components.securitySchemes entry (e.g., HTTP Bearer / JWT or API key header) appropriate to the gateway controller's auth mechanism.
2. Attach the corresponding security requirement to all protected operations across all endpoint groups.
3. Update any example requests or description text to reference the scheme where relevant.

References

• Identified in PR: https://github.com/wso2/api-platform/pull/1438
• Discussion comment: https://github.com/wso2/api-platform/pull/1438#discussion_r2972610392
• Requested by: @nimsara66