Fix OAuth 2.0 URLs in the OpenAPI v3 spec

Max Woolfrequested to merge
mw-openapi-fix-security-schemes into master

What does this MR do and why?

Fixes the OAuth 2.0 URLs in the generated OpenAPI v3 spec. They had a spurious /api prefix, and /oauth/refresh does not exist; refresh is a POST to /oauth/token.

The YAML was updated by hand to match generator output; gitlab:openapi:v3:check_docs in CI verifies it.

🤖 Generated with Claude Code

Edited by Max Woolf

Merge request reports