public.json: Add security and securityDefinitions fields

Explaining that all the currently-spec'ed endpoints that require auth
can be accessed via either basic auth or a session cookie.

Most of the secured endpoints will also return a subset of information
for unathenticated requests.  Unfortunately, there doesn't seem to be
a way to specify this in Swagger at the moment [1].

At the moment, the only unsecured endpoints are:

* GET /categories
* GET /category/{id}

[1]: https://github.com/swagger-api/swagger-spec/issues/14#issuecomment-65910678