openapi: an object a $ref reaches under an x- key is never validated #872

Problem

load runs the library's Validate over the model before references resolve, and #545 added a pass for the objects resolution brings in from another document. An object that a $ref reaches in the same document, at a location outside the OpenAPI model (under an x-* key), gets neither. It is held only to the checks its unmarshal makes, and every finding that only Validate makes is lost for it.

openapi: 3.1.0
info: {title: T, version: "1"}
security:
  - key: []
  - oidc: []
  - oauth: []
paths:
  /x:
    get:
      parameters:
        - $ref: '#/x-params/q'
      responses: {"200": {description: ok}}
x-schemes:
  key: {type: apiKey, in: header}
  oidc: {type: openIdConnect}
  oauth: {type: oauth2}
x-params:
  q: {name: q, schema: {type: string}}
components:
  securitySchemes:
    key: {$ref: '#/x-schemes/key'}
    oidc: {$ref: '#/x-schemes/oidc'}
    oauth: {$ref: '#/x-schemes/oauth'}

morphic validate reports one finding, which the parameter's unmarshal makes:

error openapi/validation/validation-required-field xgen.yaml#/paths/~1x/get/parameters/0: `parameter.in` is required, at 18:6 of xgen.yaml

Write the same four objects inline and it reports five:

error openapi/validation/validation-allowed-values inline.yaml:11:11: parameter.in must be one of [`query, querystring, header, path, cookie`]
error openapi/validation/validation-required-field inline.yaml:11:11: `parameter.in` is required
error openapi/validation/validation-required-field inline.yaml:21:10: `securityScheme.name` is required for type=apiKey
error openapi/validation/validation-required-field inline.yaml:22:11: `securityScheme.openIdConnectUrl` is required for type=openIdConnect
error openapi/validation/validation-required-field inline.yaml:23:12: `securityScheme.flows` is required for type=oauth2

All three schemes intern with no report, though each omits a field OpenAPI requires. Checked at bdbabdb.

Why it matters

It is #545's gap for the source document itself. It also reaches lowering rules that leave a REQUIRED field to the loader's finding: #727's oauth2-no-flow stands aside where the library's flows rule fails an object, so an absent flows under an x-* key has no report from either side.

Expected

Every object the compiler lowers is held to the same checks wherever it is written. One way, mirroring #545: after resolution, run Validate on each object a same-document reference reached outside the model, and report its findings at that object's position.

Related: #545, #537.