usually we use the OAuth2 security schema. but public endpoints
do not have this security constraint. callbacks don't authenticate
against the called endpoint.

For reference, the warning was (one example):

> Every operation should have security defined on it or on the root level.
>
> 418 | get:
>     | ^^^
> 419 |   operationId: get-destination-key
> 420 |   summary: Ruft einen JWK des Zustelldienstes ab
>
> Warning was generated by the security-defined rule.

The default is `false` so removing the parameter works.

See planning#501 (comment 107371)

Endpoints:
  - GET /v1/destinations/{destinationId}
  - GET /v1/destinations/{destinationId}/keys/{keyId}
  - GET /v1/info
  - GET /.well-known/jwks.json

See https://swagger.io/specification/#media-type-object

Marco Holz authored 2 years ago and Jonas Gröger committed 2 years ago

This reverts commit 514ac74c

So we have to include it separately. It's a little more text.

See https://github.com/OAI/OpenAPI-Specification/issues/417

* The "old" Destination is now in destination-any but still called Destination.
* There is now a PublicDestination (w/o contactInfo and callback) and a PrivateDestination
* Removed notice about missing fields depending on scope (since its now obvious from the schema)

Reasoning: It't not version 20 but version 2.