fix: Address Sonar S1192 and S107 in security additions

Author: thced

src/main/java/com/retailsvc/http/Request.java

@@ -69,6 +69,10 @@ public Request(
    * @param headerLookup first-value, case-insensitive header lookup; returns {@code null} if absent
    * @param principals principals stashed by the security filter, keyed by scheme name
    */
+  // Request is transport-neutral and assembled from primitives at the adapter boundary; collapsing
+  // these into a holder type would just move the parameter count one level out without simplifying
+  // the call site, so the 8-arg constructor is preferred over the rule's 7-param limit.
+  @SuppressWarnings("java:S107")
   public Request(
       byte[] body,
       Object parsed,

src/main/java/com/retailsvc/http/spec/Spec.java

@@ -33,6 +33,7 @@ public record Spec(
     List<SecurityRequirement> security) {
 
   private static final String SCHEMA_KEY = "schema";
+  private static final String SECURITY_KEY = "security";
   private static final String SCHEMA_REF_PREFIX = "#/components/schemas/";
   private static final String PARAMETER_REF_PREFIX = "#/components/parameters/";
 
@@ -151,7 +152,7 @@ public static Spec from(Map<String, Object> raw) {
           entry.getKey(), SecuritySchemeParser.parse((Map<String, Object>) entry.getValue()));
     }
     List<SecurityRequirement> rootSecurity =
-        SecuritySchemeParser.parseRequirements((List<Object>) raw.get("security"));
+        SecuritySchemeParser.parseRequirements((List<Object>) raw.get(SECURITY_KEY));
     return new Spec(
         openapi,
         info,
@@ -286,9 +287,9 @@ private static Operation parseOperation(
     Map<String, Response> responses =
         parseResponses((Map<String, Object>) raw.getOrDefault("responses", Map.of()));
     Optional<List<SecurityRequirement>> opSecurity =
-        raw.containsKey("security")
+        raw.containsKey(SECURITY_KEY)
             ? Optional.of(
-                SecuritySchemeParser.parseRequirements((List<Object>) raw.get("security")))
+                SecuritySchemeParser.parseRequirements((List<Object>) raw.get(SECURITY_KEY)))
             : Optional.empty();
     return new Operation(
         opId, method, path, body, params, responses, extractExtensions(raw), opSecurity);