The ':' character is not allowed in URLs and should not be used in scope names.

usually we use the OAuth2 security schema. but public endpoints
do not have this security constraint. callbacks don't authenticate
against the called endpoint.

For reference, the warning was (one example):

> Every operation should have security defined on it or on the root level.
>
> 418 | get:
>     | ^^^
> 419 |   operationId: get-destination-key
> 420 |   summary: Ruft einen JWK des Zustelldienstes ab
>
> Warning was generated by the security-defined rule.

using npx, we can run all redocly commands without doing a global
install of redocly/cli (-g flag).

I also noticed we were using `latest` which outside of dev tests
is not recommended.

Some shorthand flags were also migrated to the long ones (--output).