added security sample

This is a partial implementation for security--the definitions of the security schemes are not complete (see comments in-line, but the association to operations and structure should be working.
How do you indicate which OAuth flow will be used? Is that handled in the schema?