"MUST Secure Endpoints" violation using Bearer Auth

[cberg-zalando]

Even with the implementation of #1247, our builds still fails due to violating MUST Secure Endpoints endpoints saying e.g. The scope 'BearerAuth/wrapping-eligibility.read' is not specified in the clientCredentials flow of the OAuth2 security definition (see https://sunrise.zalando.net/cdp/ghe/broadway/wrapping-eligibility/l-2fdr94fskn5ymahu4h82yvirbc/steps/0/logs for details).

As the RESTful API guidelines do not mention anything about specifying scope information, either the check needs to be adjusted or something is missing in the guidelines.

[vadeg]

@cberg-zalando thank you for creating the ticket. There is a bug in one of the checks. The mitigation strategy for now is to use oauth2 security scheme instead of bearer.

[cberg-zalando]

I also learned that the definition of scopes before OpenAPI 3.1.0 is actually a violation, so the ideal situation would be if zally would support the latest OpenAPI version as outlined already in #1230.

[tkrop]

@vadeg I actually fixed the first part in #1247. However, I overlooked, that OpenAPI 3.1.0 added scopes for Bearer Authentication that conflicts with the current scope validation check. I will try to fix this too, but I'm currently not sure what prevents 3.1.0 specs from being handled by Zally. Any hint about this is welcome.

[vadeg]

@tkrop thanks. I am fixing this one already.