feat(symfony,laravel): Swagger UI plugin to log in from the documentation

[ViPErCZ]

Q	A
Branch?	main
Tickets	n/a
New feature?	yes
Deprecations?	no
License	MIT

Swagger UI: log in from the documentation

Testing a secured API in Swagger UI means: scroll to the login operation, execute it, select the token, copy it, open the "Authorize" dialog, paste, confirm. Once the token expires,
repeat. The top "Authorize" button is useless until you already have a token, and API Platform applies the security requirements globally, so the login operation itself shows a padlock and
receives the (possibly expired) token.

This PR adds an opt-in Swagger UI plugin (swagger-ui-login-plugin.js) that solves this on the API Platform side, without touching the vendored swagger-ui bundle:

• "Login" button (user icon, hidden while logged in) next to the top "Authorize" button. It opens a dialog styled like the "Authorize" one: select of the login operations, a form
  generated from the request body schema (readOnly properties skipped, password fields masked, JSON editor fallback for non-flat schemas), the request is sent through swagger-client
  exactly like "Execute" (servers, requestInterceptor, withCredentials), and the result is shown ("Authorized" + "Logout", or the HTTP status and body on failure).
• "Authorize" / "Logout" button in the response body of a login operation executed with "Try it out", next to the "Download" button.
• Both apply the token via authActions.authorizeWithPersistOption, so the padlocks switch, subsequent requests send the Authorization header and persistAuthorization is honoured.
  Supported schemes: http bearer and apiKey header (a Bearer prefix is added for the Authorization header unless prefix is configured).
• Login operations are opted out of the global security requirements (security: [] unless declared explicitly), so they have no padlock and never receive the token.

Login operations are declared either per operation with the x-apiplatform-login vendor extension (OpenApiFactory::API_PLATFORM_LOGIN):

#[Post(uriTemplate: '/auth', openapi: new Model\Operation(
    extensionProperties: ['x-apiplatform-login' => ['securityScheme' => 'JWT', 'tokenPath' => 'token']],
))]

or globally through the existing swagger_ui_extra_configuration (handy when the login route is added by a third-party decorator such as LexikJWTAuthenticationBundle):

api_platform:
  swagger:
    http_auth: { JWT: { scheme: bearer, bearerFormat: JWT } }
    swagger_ui_extra_configuration:
      persistAuthorization: true
      apiPlatformLogin:
        operations:
          - { operationId: login_check_post, securityScheme: JWT, tokenPath: token }
          - { path: /customer_login_check, method: post, securityScheme: JWT, tokenPath: data.jwt }
        dialog: true          # "Login" button + dialog (default true)
        responseButton: true  # button in the response body (default true)

A plain list of mappings is accepted as a shorthand. Without any configuration nothing changes in the UI.

Branch:

• main for new features

Implementation notes

• The plugin lives next to init-swagger-ui.js (not in swagger-ui/, which tools/update-js.sh wipes) and only uses the public Swagger UI plugin API (wrapComponents
  authorizeBtn/liveResponse/responseBody, wrapActions updateJsonSpec, fn.execute). init-swagger-ui.js appends it to plugins when the script is loaded.
• Laravel: SwaggerUiProcessor now also exposes persistAuthorization and a new swagger_ui.extra_configuration option (both were missing compared to the Symfony implementation).
• Only http and apiKey schemes are handled; oauth2 / openIdConnect keep the standard flow.