fix(spec): use global apiKey security for GET /models/user

[rajarshidattapy]

Body

Fixes#581.

Problem

models.list_for_user() is the only method in the SDK (1 of 95 operations) that requires
an operation-level security= argument, so the client-level api_key is ignored for it:

OpenRouter(api_key="sk-or-v1-...").models.list_for_user()
# TypeError: Models.list_for_user() missing 1 required keyword-only argument: 'security'

The cause is in the OpenAPI document, not the generator. components.securitySchemes
declares two byte-identical schemes — apiKey and bearer, both http/bearer with the
same description. The document default is apiKey (8 references), and listModelsUser
alone overrides it with bearer (1 reference, the only one in the spec). Because the name
differs from the global scheme, global security can't be hoisted and the generator emits a
required per-operation credential.

Change

A new overlay, applied last in the chain, does the two removes suggested in the issue:

• drops security: [bearer] from $.paths["/models/user"].get, so the operation inherits
  the document-level security: [apiKey] like the other 94 operations
• removes $.components.securitySchemes.bearer, which has no references left afterwards

.speakeasy/out.openapi.yaml is the output of the overlay chain, so the same two removes
are applied there to keep the checked-in artifact in sync (-6 lines).

.speakeasy/overlays/fix-models-user-security.overlay.yaml | new, 21 lines
.speakeasy/workflow.yaml | +1
.speakeasy/out.openapi.yaml | -6

Verification

The Speakeasy CLI isn't available in my environment, so I verified the spec directly:

• both overlay targets match in in.openapi.yaml — a no-matching overlay would silently do
  nothing, the failure mode the deprecated-beta-responses-alias overlay comments warn
  about — and bearer parses as an exact duplicate of apiKey
• after the change, out.openapi.yaml has securitySchemes == {apiKey}, no security key
  on listModelsUser, global security still [{apiKey: []}], and zero operations across
  all 72 paths referencing a missing scheme
• operationId: listModelsUser, x-speakeasy-name-override: listForUser, and the
  pagination extensions on the operation are untouched
• all 8 registered overlays exist and parse

src/ is intentionally unchanged.

This PR only touches the spec and overlay chain; regenerating needs the Speakeasy CLI.
On the follow-up regen, expect security to drop off Models.list_for_user /
list_for_user_async (models_.py:1067, :1239), operations.ListModelsUserSecurity to
disappear, and the OPENROUTER_BEARER snippet to fall out of
docs/sdks/models/README.mdx. Worth confirming on the regen PR before closing #581.

One judgment call

Removing the bearer scheme means a future monorepo sync that points an operation at
bearer will fail generation loudly rather than silently shipping another
required-credential method. I think loud is the right trade here, but if you'd rather not
risk blocking the auto-merge bot, drop the second overlay action — the /models/user
override removal alone fixes the reported symptom.

Note that the real fix belongs in the monorepo spec; this overlay is the local mitigation
until bearer is removed upstream.