Add new extension property to hide controllers and routes from openapi.json

[hacksparrow]

Description / Steps to reproduce / Feature proposal

We should be able to mark some controllers and routes as internal/private, meaning they are not listed in openapi.json.

Suggested property name is x-internal.

Example usecase is #1848.

Current Behavior

There is no way to mark controllers and routes as private.

Expected Behavior

Should be able to mark controllers and routes as private.

See Reporting Issues for more tips on writing good issues

[hacksparrow]

Featured landed via #1896.