Recognize the standard DPoP OpenAPI HTTP security scheme

[saltbo]

Problem

OpenAPI can declare RFC 9449 DPoP as a standard HTTP authentication scheme:

components:
  securitySchemes:
    DPoP:
      type: http
      scheme: DPoP

Restish currently normalizes non-Basic and non-Bearer HTTP schemes to a generic unsupported credential kind. Valid DPoP contracts therefore produce an unsupported-security warning.

DPoP cannot be represented safely as a static Bearer or API-key credential because every protected request requires a proof bound to the request URI, method, token, and client key.

Expected behavior

• recognize HTTP DPoP schemes case-insensitively
• preserve DPoP as a distinct credential requirement
• provide a proof-capable DPoP authentication type rather than treating DPoP as a static token
• distinguish a configured or deferred proof-capable credential from a missing credential in diagnostics
• generate a fresh proof for each request and enforce normal origin, redirect, retry, and secret-redaction boundaries

Reproduction

1. Connect or synchronize an API whose OpenAPI document uses the security scheme above.
2. Inspect security diagnostics.
3. Observe that the standards-compliant scheme is reported as unsupported.

References

• RFC 9449
• IANA HTTP Authentication Scheme Registry
• OpenAPI 3.1 Security Scheme Object