fix(openapi): Fix CKV_OpenAPI_20

[tsmithv11]

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Description

Checks that HTTP is used before checking if an API key is sent over cleartext

Fixes #5300

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my feature, policy, or fix is effective and works
• New and existing tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

[gruebel]

🏆

[ziggythehamster]

I’m mobile so can’t make a ticket very easily but I noticed two small issues:

• typo: you wrote wp but meant ws for WebSocket
• none of the tests actually try a ws:// url

[ziggythehamster]

Oh and I guess a third thing, OpenAPI 3.0 lets ws:// slip through where OpenAPI 2.0 would reject it if the correct scheme were listed.

[tsmithv11]

@ziggythehamster thanks for the review! I fixed those three here: #5317 Can you take a look?