[codex] Support remaining official security schemes

[HavenDV]

Summary

• add generator support for the remaining official OpenAPI security schemes: cookie apiKey, openIdConnect, and mutualTLS
• carry SchemeId through generated runtime auth metadata so requirement matching stays stable across multiple schemes of the same type
• add owned HttpClientHandler support for generated mutual TLS clients and refresh the security-related snapshots

Why

Issue #231 called out three gaps in the generated clients:

• cookie apiKey auth was not applied at request time
• openIdConnect generated as a no-op instead of a usable bearer-style helper
• there was no generated client-certificate hook for mutualTLS

The root cause was that the generator only had first-class handling for header/query apiKey, HTTP auth, and OAuth2, and requirement matching keyed mostly on scheme type instead of scheme identity.

Impact

• generated clients can now send cookie auth correctly
• generated clients expose OpenID Connect discovery metadata and auth helpers
• generated clients can configure mutual TLS certificates when AutoSDK owns the HttpClient
• generated security requirement matching is now scheme-aware, which avoids collisions between multiple auth schemes of the same type

Validation

• dotnet build /p:TreatWarningsAsErrors=true
• dotnet test src/tests/AutoSDK.UnitTests/AutoSDK.UnitTests.csproj --filter "FullyQualifiedName~AuthorizationGenerationTests|FullyQualifiedName~HttpTests"
• dotnet test src/tests/AutoSDK.IntegrationTests.Cli/AutoSDK.IntegrationTests.Cli.csproj --filter "FullyQualifiedName~Generate_WithRemainingOfficialSecuritySchemes_BuildsAndEmitsSupport"
• dotnet test src/tests/AutoSDK.SnapshotTests/AutoSDK.SnapshotTests.csproj

Closes #231

[HavenDV]

Reopening to retrigger pull_request checks on the current head SHA.