fix: Correct ZAP API scan invocation

The previous script passed `-t` twice; the second occurrence
silently overwrote the OpenAPI spec target, so the scan never
loaded `src/test/resources/openapi.json`. The host override for
`zap-api-scan.py` is `-O`, not a second `-t`.

Also add a shebang, `set -euo pipefail`, `--rm` on docker run,
and a usage comment pointing at the ServerLauncher prerequisite.

Author: thced

zap.sh

@@ -1,7 +1,15 @@
-docker run -v "$(pwd)":/zap/wrk/:rw -t ghcr.io/zaproxy/zaproxy:stable zap-api-scan.py \
+#!/usr/bin/env bash
+# Run a ZAP API scan against a locally running OpenAPI server.
+# Prerequisite: the example server must be listening on :8080, e.g.
+#   mvn test-compile exec:java \
+#     -Dexec.mainClass=com.retailsvc.http.start.ServerLauncher \
+#     -Dexec.classpathScope=test
+set -euo pipefail
+
+docker run --rm -v "$(pwd)":/zap/wrk/:rw -t ghcr.io/zaproxy/zaproxy:stable zap-api-scan.py \
     -t src/test/resources/openapi.json \
-    -P 8080 \
     -f openapi \
-    -s -g gen.conf \
-    -r zap-report.html \
-    -t http://host.docker.internal:8080
+    -O http://host.docker.internal:8080 \
+    -s \
+    -g gen.conf \
+    -r zap-report.html