Allow URIs for Security Schemes

This allows Security Requirement Objects to reference Security Scheme Objects by URI instead of implicit component name. Without this ability, it is difficult to share Security Schemes in a way that is consistent with re-usable component documents.

This approach provides parity with how the Discriminator Object's mapping field works.

Also add a note about the complexity of these rules to the Security Considerations section.