add skipVerifyScopeWithoutSpec flag to openapi-security.yml

[stevehu]

to skip the scope verification if the specification doesn't exist for the endpoint. This will only be used in a shared gateway instance.