public.json: Add security and securityDefinitions fields

Explaining that all the currently-spec'ed endpoints that require auth
can be accessed via either basic auth or a session cookie.

Most of the secured endpoints will also return a subset of information
for unathenticated requests.  Unfortunately, there doesn't seem to be
a way to specify this in Swagger at the moment [1].

At the moment, the only unsecured endpoints are:

* GET /categories
* GET /category/{id}

[1]: OAI/OpenAPI-Specification#14 (comment)

public.json

@@ -14,6 +14,26 @@
       "url": "http://opensource.org/licenses/MIT"
     }
   },
+  "security": [
+    {
+      "basic": []
+    },
+    {
+      "sessionCookie": []
+    }
+  ],
+  "securityDefinitions": {
+    "basic": {
+      "type": "basic",
+      "description": "Basic authentication (http://tools.ietf.org/html/rfc2617#section-2)"
+    },
+    "sessionCookie": {
+      "type": "apiKey",
+      "in": "header",
+      "name": "cookie",
+      "description": "Session cookie (http://tools.ietf.org/html/rfc6265)"
+    }
+  },
   "host": "api.azurestandard.com",
   "schemes": [
     "http",
@@ -413,6 +433,7 @@
         "tags": [
           "category"
         ],
+        "security": [],
         "parameters": [
           {
             "name": "product",
@@ -460,6 +481,7 @@
         "tags": [
           "category"
         ],
+        "security": [],
         "parameters": [
           {
             "name": "id",