feat: add security field at the operation level

[LokeshRishi3]

Description
We are using AsyncAPI specifications for publishing the subscriber specific details of our topics and associated payloads for our HTTP push use cases.

Our subscribable channels(or topics) are protected by a set of OAuth scopes (authorization code or client credentials) - that a potential subscriber needs to be aware of.

Here is a sample contract.

We are able to accommodate almost every detail of interest to an integrator/subscriber (THANK YOU) - with the exception of being able to call out the oauth scopes necessary for the subscription to the topic - i.e. the security aspect at the channel or rather channel/operation level.

The current specification is perhaps more aligned with a broker based topology - but ours is a pure push use case (to registered webhooks) and we need an ability to call out any security aspects at the channel operation level.

Related issue(s)
Resolves #434

[github-actions]

Welcome to AsyncAPI. Thanks a lot for creating your first pull request. Please check out our contributors guide useful for opening a pull request.
Keep in mind there are also other channels you can use to interact with AsyncAPI community. For more details check out this issue.

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

[derberg]

@LokeshRishi3 hey, thanks a lot for this one. Are you also coming from ebay with the same use case we discuss in the proposal? So far your PR follows approach when on operation level, only operation security applies, but we are getting conclusions there that server security might apply too, so server function should then return not only operation sec requirements but also the ones provided in the associated server.

Please join discussion asyncapi/spec#584

[LokeshRishi3]

@derberg Yes! 🙂
Did you mean:

server security function should then return not only operation sec requirements but also the ones provided in the associated server.

Also, I realized that I did not add additional tests for the parse method and it seems like to add those we first need to publish a new spec with operation-level security asyncapi/spec-json-schemas#148

[derberg]

yes, you need to wait for the outcome from the spec repo discussion