OpenAPI extension creates bad oapi export with @RolesAllowed

[pilhuhn]

Describe the bug

Adding a @RolesAllowed annotation to a method that is to be documented with OpenAPI results in the following verification warning:

Security Requirement 'SecurityScheme' scopes must be an empty array because the referenced Security Definition not "oauth2" or "openIdConnect".
Security Requirements can be specified for basic, apiKey, or oauth. When using basic or apiKey authentication, the security requirement must NOT provide a list of scopes (the list of scopes must be empty). In other words, scopes are only valid when using OAuth 2 authentication.

The generated JSON looks like

            security:
                -
                    SecurityScheme:
                        - HullaRole

This does not match the expectation from OpenAPI https://github.com/OAI/OpenAPI-Specification/blob/3.0.1/versions/3.0.1.md#securityRequirementObject

Expected behavior

Create correct openapi

Actual behavior

No response

How to Reproduce?

Use the openapi-swagger-quickstart with the following class

@Path("/bla")
public class Main {

    @GET
    @RolesAllowed({"HullaRole"})
    public String getBla() {
        return "Hello OpenAPI";
    }
}

Then export the openapi.json and inspect it

Output of uname -a or ver

No response

Output of java -version

No response

GraalVM version (if different from Java)

No response

Quarkus version or git rev

2.11.2 Final

Build tool (ie. output of mvnw --version or gradlew --version)

No response

Additional information

No response

[quarkus-bot]

/cc @EricWittmann, @MikeEdgar, @phillip-kruger

[TheoBullat]

Hi, in the newest OpenApi spec: https://github.com/OAI/OpenAPI-Specification/blob/3.1.0/versions/3.1.0.md
It is now allowed to put scope for types different than oauth2 or openIdConnect:

If the security scheme is of type "oauth2" or "openIdConnect", then the value is a list of scope names required for the execution, and the list MAY be empty if authorization does not require a specified scope. For other security scheme types, the array MAY contain a list of role names which are required for the execution, but are not otherwise defined or exchanged in-band.

But with the changes from this issue, it is no longer possible to add scopes with RolesAllowed. The generated json ends up like:
security: - SecurityScheme: []

Would it be possible to allow back scopes to be found with the RolesAllowed annotation when the openapi version used is 3.1.0 or more?