Add AuthType.Custom and AuthType.Or support to OpenAPIGen

**Is your feature request related to a problem? Please describe.** When using AuthType.Custom (e.g., `AuthType.Custom(HttpCodec.headerAs[String]("X-Api-Token"))`), the OpenAPI spec generated by `OpenAPIGen.fromEndpoints` is missing all authentication information. This is because OpenAPIGen only handles `Basic`, `Bearer`, `Digest`, and `ScopedAuth`. But `AuthType.Custom` and `AuthType.Or` silently fall through to empty results in both `endpointSecurity()` and `httpSecuritySchemes()`. **Describe the solution you'd like** `OpenAPIGen` should handle `AuthType.Custom` and `AuthType.Or` in both `endpointSecurity()` and `httpSecuritySchemes()`: - `AuthType.Custom`: Decompose the custom codec using `AtomizedMetaCodecs.flatten()` and generate `SecurityScheme.ApiKey` entries for each header/query atom. Support multiple atoms composed via `++`. Apply a cookie heuristic: if the header name is "cookie" (case-insensitive), use `ApiKey.In.Cookie` instead of `ApiKey.In.Header`. - `AuthType.Or`: Recursively collect SecurityRequirement and SecurityScheme entries from both sides of the Or. For example, an endpoint with `AuthType.Custom(HttpCodec.headerAs[String]("X-Api-Token"))` should produce: ```json { "securitySchemes": { "x-Api-Token": { "type": "apiKey", "name": "x-Api-Token", "in": "header" } } } ``` **Describe alternatives you've considered** - Manually constructing the OpenAPI object instead of using OpenAPIGen — this works but defeats the purpose of the generation utility. - Using `AuthType.Bearer` or `AuthType.Basic` as a workaround — this produces incorrect OpenAPI output that doesn't match the actual auth mechanism. **Additional context** PR is created #3991