fix(openapi): address review feedback — correctness, security, and performance improvements

[Copilot]

Addresses a batch of correctness bugs, a security improvement, and code quality issues raised in the PR review of the OpenAPI module.

Correctness fixes

• YAML endpoint (/openapi.yaml) now serves raw spec bytes with application/yaml content-type instead of re-serialised JSON
• r.Body == http.NoBody — broken check replaced: body is now read first, then length is checked for required-body validation; read errors are logged and returned rather than silently ignored
• Integer schema validation — validateJSONValue now rejects 3.14 for an integer-typed field (math.Trunc check)
• Enum comparison — validateJSONValue uses type-aware equality (e == val) with explicit int/float64 reconciliation to prevent int(1) matching string("1") via fmt.Sprintf; nil enum values are skipped
• Pattern validation — invalid regex in a schema pattern now returns a descriptive error instead of silently treating the value as non-matching

Security

• htmlEscape replaced with html.EscapeString from the standard library

Improvements

• Swagger UI CDN is now configurable via SWAGGER_UI_ASSETS_BASE_URL env var (useful for air-gapped deployments); defaults unchanged
• wireOpenAPIRoutes reduced from O(n²) to O(n) by building a name→router map once before iterating OpenAPI modules
• specJSON cached on the module struct during RegisterRoutes instead of being re-marshaled if called multiple times
• Type mismatch errors now include the actual Go type (e.g., "field "x" must be a string, got float64")
• Extracted validateStringConstraints helper shared by both validateScalarValue and validateJSONValue to eliminate duplication

Tests

• Added pattern validation tests: valid match, mismatch, and invalid regex
• Added integer fractional-value rejection and type-mismatch message content tests
• Added path parameter ({petId}) validation tests using r.SetPathValue
• Test temp file permissions changed from 0600 → 0644

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.