make it explicit that auth is optional

Auth was added in c077573. Most/All our endpoints are available without
authentication (but some records may be protected) - let's make it
explicit that unauthenticated use is legitimate.

As far as I can tell this has no impact in swagger ui, though.

See
OAI/OpenAPI-Specification#14

specs/openapi.json

@@ -54,6 +54,7 @@
         "$ref": "./paths/index.json"
     },
     "security": [
+        {},
         { "bearerAuth": [] }
     ]
 }