Fix security schemes in OpenAPI definitions

There are not a lot of different changes but there is a lot of search & replace.

The changes are:

Add the Authorization: Bearer security scheme as a different possibility to the query parameter for the client-server and identity APIs.
Fix the definition of the security scheme of the application service, to take advantage of the built-in OpenAPI schemes
Use $ref properly to reuse the security schemes. It's a bit more verbose as each scheme needs to be imported individually.

This can be reviewed per commit.

There is no difference in the spec output, only in the OpenAPI output.

matrix-org / matrix-spec