[rust-server] Generate the auth scheme precedence tests

[twistali]

The auth scheme precedence tests added in #24607 were hand-written and duplicated across two samples. Because they are not emitted by the templates, they only cover the specs someone remembered to write them for, and they have to be maintained by hand as new samples are added.

Emit them from a new tests-auth-scheme-precedence.mustache supporting file instead. RustServerCodegen publishes a small description of the spec's security schemes (which schemes are declared, the apiKey parameter names, and whether Basic/Bearer are dispatched before the apiKey block); the template selects the test cases and expected outcomes from those flags.

This drops the hand-written files and covers four samples instead of two. Reintroducing the untyped from_headers bug that #24607 fixed now fails in all four, where the hand-written tests caught it in two.

Follow-up to #24607.

#24607 fixed an authorization bypass in  rust-server : after swagger-rs made  swagger::auth::from_headers  untyped, an unrestricted  if let Some(auth) = from_headers(headers)  in the Basic block would swallow a  Bearer  request and make every later block — including the in-header apiKey block — unreachable. The fix was to bind with a type-restricted pattern ( Some(auth @ AuthData::Basic(..)) ,  Some(bearer @ AuthData::Bearer(..)) ).

That PR also added tests, but they were hand-written and checked straight into two sample output directories. That has two problems:

1. They only cover the specs someone remembered to write them for. The other rust-server samples with security schemes got nothing.
2. They live in  samples/ , which is otherwise entirely generated, so they have to be maintained by hand and are easy to lose when regenerating.

This PR emits them from the templates instead.

What changed

• New supporting file  rust-server/tests-auth-scheme-precedence.mustache , emitted as  tests/auth_scheme_precedence.rs  for any spec that declares a security scheme the generator dispatches on.
•  RustServerCodegen  gains ~60 lines that publish a small description of the spec's security schemes into the supporting-file bundle: which schemes are declared, the apiKey parameter names, and whether the Basic/Bearer blocks are emitted before the apiKey block. Test-case selection and expected outcomes live in the template, not in Java.
• Both hand-written  tests/auth_scheme_precedence.rs  files are deleted, replaced by generated ones.

The test drives the generated  Api::from(&request)  dispatch through a real  hyper::Request , so it exercises the emitted code rather than asserting on template text.

PR checklist

• Read the contribution guidelines.
• Run the following to build the project and update samples:

  ./mvnw clean package || exit
  ./bin/generate-samples.sh ./bin/configs/*.yaml || exit
  ./bin/utils/export_docs_generators.sh || exit
  

  (For Windows users, please run the script in WSL)
  Commit all changed files.
  This is important, as CI jobs will verify all generator outputs of your HEAD commit as it would merge with master.
  These must match the expectations made by your contribution.
  You may regenerate an individual generator by passing the relevant config(s) as an argument to the script, for example ./bin/generate-samples.sh bin/configs/java*.
  IMPORTANT: Do NOT purge/delete any folders/files (e.g. tests) when regenerating the samples as manually written tests may be removed.
• If your PR is targeting a particular programming language, @mention the technical committee members, so they are more likely to review the pull request.

---

Summary by cubic

Generate auth‑scheme precedence tests for rust-server from a template and track apiKey shadowing per location. Old: hand‑written tests in two samples and a single “precedes first apiKey” flag. New: RustServerCodegen emits tests/auth_scheme_precedence.rs with separate header/query precedence, expanded cases, and updated samples, without changing runtime behavior.

• Java: RustServerCodegen.addAuthSchemeTestsToBundle publishes authTestHasBasic, authTestHasBearer, per‑location precedence flags (authTestBasicPrecedesHeaderApiKey, authTestBearerPrecedesHeaderApiKey, authTestBasicPrecedesQueryApiKey, authTestBearerPrecedesQueryApiKey), and apiKey names (authTestApiKeyHeader lowercased; authTestApiKeyQuery as declared). Adds the tests-auth-scheme-precedence.mustache supporting file only when any scheme exists. OAuth is treated as Bearer.
• Template: tests-auth-scheme-precedence.mustache generates sole‑credential and reachability tests for header and query apiKeys. Test names reflect declared schemes.
• Samples: replace hand‑written tests and add generated ones in openapi-v3, overlapping-auth-schemes, petstore-with-fake-endpoints-models-for-testing, and ping-bearer-auth. Reintroducing the untyped from_headers bug now fails across all four; total tests increase from 19 to 21.

^{Written for commit fb098e2. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed across 10 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[wing328]

thanks for the pr

cc @frol (2017/07) @farcaller (2017/08) @richardwhiuk (2019/07) @paladinzh (2020/05) @jacob-pro (2022/10) @dsteeley (2025/07)