build introspect URL from x-server-url + x-introspect-path

- security.py: read x-server-url and x-introspect-path separately
  from resolved security scheme, join to form introspect URL

openapi_first/security.py

@@ -97,7 +97,10 @@ def _build_dependency(scheme_name: str, scheme: dict) -> Callable | None:
     scheme_type = scheme.get("type")
 
     if scheme_type == "http" and scheme.get("scheme") == "bearer":
-        return _make_bearer_dependency(scheme.get("x-introspect-url"))
+        server_url = scheme.get("x-server-url", "")
+        introspect_path = scheme.get("x-introspect-path", "/introspect")
+        introspect_url = server_url + introspect_path if server_url else None
+        return _make_bearer_dependency(introspect_url)
 
     return None