Empty security list doesn't override top-level security declaration

[akurtz-penguin]

https://github.com/p1c2u/openapi-core/blob/master/openapi_core/validation/request/validators.py#L90

    def _get_security(self, request, operation):
        security = operation.security or self.spec.security
        if not security:
            return {}

operation.security is [] if it's not set, and [] if it's set with security: [], so self.spec.security will always be used.

Workaround is to use an array with an empty security requirement.

security:
  - {}