Improve backward-compatibility testing (#546)

- Attempts to be exhaustive on backward-compatibility coverage to raise confidence that future refactors will not introduce unintended regressions.
- Each incompatible condition is tested separately by comparing two spec files where the only difference is that fine-grained incompatible condition.
- In some cases the current behavior appears incorrect. Tests are still added for these to avoid unintended regression, but are given TODO comments for later follow-up.
- Pre-existing tests have been removed if they are redundant to avoid confusion and to follow the convention.

Closes #545

Author: westse

core/src/main/java/org/openapitools/openapidiff/core/model/ChangedSecurityScheme.java

@@ -44,6 +44,13 @@ public DiffResult isCoreChanged() {
         && !changedBearerFormat
         && !changedOpenIdConnectUrl
         && (changedScopes == null || changedScopes.getIncreased().isEmpty())) {
+
+      // TODO: Dead code removal opportunity for changedType and changedIn. It appears that
+      // SecuritySchemaDiff will never be given the chance to detect differences TYPE and
+      // IN differences because that case has already been detected and filtered out by
+      // SecurityRequirementsDiff and recorded as a dropped requirement in
+      // ChangedSecurityRequirements.
+
       return DiffResult.COMPATIBLE;
     }
     return DiffResult.INCOMPATIBLE;