WowOpenApiSecurity
How a caller of the public routes presents its identity, as the springdoc document declares it: the document's security schemes, by name, and its global security, one requirement naming them all, since a caller presents them together, so that Swagger UI's "Try it out" sends the identity.
The host fills it from its CallerResolver (of): CoSec's resolver takes a bearer token (COSEC); the host's development callers take the Wow-* identity headers (DEVELOPMENT), each its own scheme in the one requirement, so Swagger UI's Authorize sets those a request needs and sends them together; the anonymous caller, and an application's own resolver, declare none. An application with a resolver of its own declares how it authenticates by a bean of this type, which replaces the host's.