Add PRIVATE-TOKEN security scheme to the OpenAPI v3 spec

Max Woolfrequested to merge
mw-openapi-add-private-token-scheme into master

What does this MR do and why?

Adds an apiKey security scheme for the PRIVATE-TOKEN header to the generated OpenAPI v3 spec. The REST authentication docs recommend this header for personal, project, and group access tokens, but the spec only described Bearer and OAuth 2.0, so Scalar and generated clients could not use it.

The YAML was updated by hand to match generator output; gitlab:openapi:v3:check_docs in CI verifies it.

🤖 Generated with Claude Code

Merge request reports