Update SessionProvider and SessionManager to allow Session Cookies and OAuth to declare OpenAPI characteristics necessary for OpenAPI specs.

Currently, our OpenAPI specification generator has no way to dynamically determine which authentication methods are loaded and how they are configured. Instead of hard-coding security definitions in the spec generator, this task allows each session provider to define its own metadata. The SessionManager will aggregate these definitions and generate safe, unique dictionary keys for the final spec.

Conditions of Acceptance

• Implemented public function in SessionProvider.php to return an array of OpenAPI security schemes provided by a session provider. Reference from spike output document: https://docs.google.com/document/d/1fQvy_Y7AIW4H-aa3HbDVqJK0Yz9ONVZynLbLcjQNKN8/edit?tab=t.0#heading=h.87it55i1sbfp
• Overrode the aforementioned public function in CookieSessionProvider.php to return a list of session cookie schemes. Reference: https://docs.google.com/document/d/1fQvy_Y7AIW4H-aa3HbDVqJK0Yz9ONVZynLbLcjQNKN8/edit?tab=t.0#heading=h.sj16trjohn9l
• Implemented public function in SessionManager.php to iterate through session providers from both Core and Extensions and aggregate the OpenAPI security schemes. This reference has a special note on class namespace-to-hyphen key naming: https://docs.google.com/document/d/1fQvy_Y7AIW4H-aa3HbDVqJK0Yz9ONVZynLbLcjQNKN8/edit?tab=t.0#heading=h.cii2b662scri.
• Reflected the SessionManager.php change in SessionManagerInterface.php.
• Added unit tests in [[ https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/core/+/refs/heads/master/tests/phpunit/includes/Session/SessionManagerTest.php | SessionManagerTest.php ]] to verify aggregation of individual OpenAPI Security Scheme Objects into a single nested array. This single nested array will become the global components.securitySchemes object in the final OpenAPI document.

References

• Parent task: T422484: [5.2.5b Epic] Add security mechanism information to the MediaWiki REST API description.
• This task resulted from T423552: [SPIKE] Add security scheme information to MediaWiki REST API description.
• A snippet from the concrete YAML sketch of a target spec that illustrates components.securitySchemes:

components:
 securitySchemes:
   MediaWiki-Session-CookieSessionProvider-Session:
     type: apiKey
     in: cookie
     name: hewikiSession
     description: |
       MediaWiki Session ID cookie.
       Note: Write operations using this method also require a CSRF token to be submitted in the request body.
   MediaWiki-Session-CookieSessionProvider-UserID:
     type: apiKey
     in: cookie
     name: hewikiUserID
     description: |
       MediaWiki User ID cookie.
       Required alongside the session ID.   
   MediaWiki-Session-CookieSessionProvider-Token:
     type: apiKey
     in: cookie
     name: hewikiToken
     description: |
       MediaWiki User Token cookie.
       Required for persistent session verification.
   MediaWiki-Extension-OAuth-SessionProvider:
     type: oauth2
     description: Authorization code flow
     flows:
       authorizationCode:
         authorizationUrl: https://example.com/w/rest.php/oauth2/authorize
         tokenUrl: https://example.com/w/rest.php/oauth2/token
         scopes: {}

View of This Task in Context of Related Tasks