Better support for parameters + basic auth hooks

This release introduces support for parameters (other than path parameters, which were already supported). Only the "simple" encoding scheme is supported so far.

This release also introduces a "handleSecurity" hook that can be configured during the call to OpenApiServer.Create. This permits consumers to apply their own security, after preflight but before CORS. I still plan to introduce more fully-featured authentication handlers later.