Fix OpenAPI to skip SecurityScheme for [AllowAnonymous] controllers

[qianchongyang]

Problem

When using [AllowAnonymous] on a controller, OpenAPI documentation still requires authentication even though anonymous access is explicitly allowed. The BearerSecuritySchemeTransformer applies security requirements to all endpoints regardless of [AllowAnonymous].

Solution

Updated the BearerSecuritySchemeTransformer to check for [AllowAnonymous] attribute on controllers. When [AllowAnonymous] is present, the security scheme requirement is skipped for that endpoint.

Validation

[AllowAnonymous]
[ApiController]
public class PublicController : ControllerBase
{
    // OpenAPI docs now correctly show no security requirement
    [HttpGet("/public")]
    public IActionResult Get() => Ok();
}

Fixes #61264

[mikekistler]

It was my understanding you had to have a transformer to add security requirements -- it is not done automatically by the framework. If that is the case, then the "fix" is not to add another transformer but just to make the original one (not even mentioned here) correctly skip adding a security requirement for an endpoint with AllowAnonymous.

Am I missing something?