fix(analyzer): a security scheme the generator cannot use costs the whole client

[giraffesyo]

Closes #62.

Two shapes stopped generation entirely:

$ go run . generate --spec spec.yaml --out ./out
Error: analyzing spec: unsupported security scheme type "openIdConnect" for "oidc"
Error: analyzing spec: unsupported http scheme "Bearer" for security scheme "auth"

No client at all, over one declaration the caller may not even be authenticating with. Any API fronted by Keycloak, Auth0, or Entra declares OIDC, and scheme: Bearer with a capital B is equivalent to bearer under RFC 7235, which registers auth scheme names case-insensitively.

Behavior now

declaration	before	after
type: openIdConnect	generation fails	bearer provider
scheme: Bearer	generation fails	bearer provider
type: mutualTLS	generation fails	warning, no provider
scheme: digest	generation fails	warning, no provider
unrecognized type	generation fails	warning, no provider

OpenID Connect is a bearer token on the wire; the discovery document is the caller's concern, not the transport's. mutualTLS is configured on the http.Client, so there is nothing for a provider to add to a request.

Unsupported schemes warn rather than pass silently, since a client with no provider for a scheme the API requires would otherwise look like it authenticates and 401:

warning: security scheme "legacy": no provider generated for http scheme "digest"
warning: security scheme "mtls": mutualTLS is configured on the HTTP transport, so no provider is generated
warning: security scheme "weird": no provider generated for unrecognized type "somethingNew"

Warnings collect on ir.Package and the CLI prints them to stderr, so the analyzer stays free of output concerns. That channel is reusable for anything else the generator has to skip.

I did not carry openIdConnectUrl into the IR. Nothing renders per-scheme metadata today, so it would be a field with no reader.

Tests

internal/analyzer/security_test.go covers a spec declaring all five shapes at once: openIdConnect and Bearer produce bearer providers, digest, mutualTLS, and an unrecognized type produce no provider and one warning each, and analysis returns no error.

gofmt, go vet ./..., and go test ./... pass.