A single OpenAPI security requirement: a map of security-scheme name to the scopes that scheme must grant. Scopes are meaningful only for OAuth2 and OpenID Connect schemes; every other scheme type takes an empty array.
Multiple entries in a requirement object are ANDed (all must be satisfied); multiple requirement objects in a list are ORed (any one satisfies).