authenticated-api example: Separating public paths from protected

[suntong]

From https://github.com/deepmap/oapi-codegen/tree/master/examples/authenticated-api

This security scheme is a global requirement for all API endpoints:

   security:
    - BearerAuth: [ ] 

This means that all API endpoints require a JWT bearer token for access, and without any specific scopes, as denoted by [].

What if I don't want all API endpoints requiring JWT bearer, and need to make some publicly accessible without JWT tokens? (This is a simplified version from the complicated one at #843). Thx.