feat: add request body access to security handlers

[eropple]

Summary

• Move security handlers from onRequest to preValidation hook, enabling access to parsed request bodies
• Add requiresParsedBody option to security schemes - when true, handlers receive a context parameter with the parsed body
• Backward compatible: existing handlers work unchanged (context is undefined when not requested)

Changes

• Hook migration: Security handlers now run in preValidation instead of onRequest
• New types: SecurityHandlerContext with body: unknown, optional requiresParsedBody on all scheme types
• Handler updates: All three handler builders (buildApiKeyHandler, buildHttpBasicHandler, buildHttpBearerHandler) pass context when requested
• Documentation: Added comprehensive autowired security section to README

Test plan

• All 62 existing tests pass (no regressions from hook change)
• 9 new tests for requiresParsedBody feature:
  • Body access for API Key, HTTP Bearer, HTTP Basic schemes
  • Combined with passNullIfNoneProvided
  • AND/OR security logic with body-aware handlers
  • Verification that requiresParsedBody is stripped from OpenAPI doc