Define values of in and name for basic security scheme

[mmccool]

In Issue #6 we noted some missing details around the parameters for the "basic" security scheme that this PR tries to address:

• "in" should be "header". As this is the default value, you can just leave it out. This PR adds an assertion saying you can either leave it out or use the default value of "header".
• The value for "name" is trickier. First, it does not have a default value, but is optional, which frankly is an oversight; it means it is technically undefined if not given. However, in the HTTP specification it also has two possible values, whether or not a proxy is used.
• This PR adds two assertions for "name", one for when a proxy is used, one for when it is not. For compatibility with the TD spec while avoiding undefined terms, this also means that "name" must ALWAYS be given. An alternative would be to define a default value for it using these rules.

We also haven't said anything about proxies in the profiles spec, but the current text does not disallow them that I can see.

---

Preview | Diff

[benfrancis]

Following up from the Profile call today. If the BasicSecurityScheme usage here is only intended to refer to HTTP Basic Auth only and RFC7235 only allows credentials to provided in an Authorization header then my comment above is a moot point because other ways of providing the credentials are not possible anyway.

---

FWIW I re-checked the EventSource and WebSocket APIs and whilst you definitely can't manually set an Authorization header (e.g. to include an OAuth2/Bearer token), I'm technically wrong that requests can't include HTTP Authentication credentials. Both APIs have a credentials mode which can send HTTP Authentication credentials along with the request, but there's no way to provide those credentials via the API. The credentials can therefore only be sent if they have already been cached by the browser, which will only work in certain limited circumstances (which probably aren't particularly useful for WoT use cases).

Anyway, I retract my comment since it probably makes little difference in practice. Sorry for the churn.

[benfrancis]

In the long term this should probably just be fixed in the TD specification, or an HTTP binding document. See https://github.com/w3c/wot-thing-description/issues/1781

[mlagally]

Profile call on March 232nd: Reviewed and approved to merge.