This "optionality" does not apply to JWE fields in general! We need to be careful not to define all of them as string|null.

chore: remove documentation about old (internal) destination API. Add remark about destination / keys duplication (planning#1788)

The ':' character is not allowed in URLs and should not be used in scope names.

usually we use the OAuth2 security schema. but public endpoints
do not have this security constraint. callbacks don't authenticate
against the called endpoint.

For reference, the warning was (one example):

> Every operation should have security defined on it or on the root level.
>
> 418 | get:
>     | ^^^
> 419 |   operationId: get-destination-key
> 420 |   summary: Ruft einen JWK des Zustelldienstes ab
>
> Warning was generated by the security-defined rule.