feat(converter): enrich OpenAPI output from Spring annotation slices

[abdul-levo]

Summary

Re-implementation of Spring annotation-driven OpenAPI enrichment,
replacing the previously reverted PRs #67/#68 with a cleaner approach.

What changed

• _enrich_from_param_annotation() — first-pass scan of objectSlices
  for PARAM+ANNOTATION usage pairs. Extracts @RequestBody,
  @PathVariable, @RequestParam, @RequestHeader into proper OpenAPI
  requestBody and parameters objects.

• _backfill_from_annotation_slices() — second-pass for Spring methods
  where atom omits the HTTP-method annotation from the slice. Correlates
  via x-atom-usages call line number.

• _build_schema_from_type() — builds an OpenAPI schema from a
  userDefinedTypes entry, with one-level nested object expansion.

• _java_type_to_schema() — maps 25+ fully-qualified Java types
  (primitives, collections, java.time.*, UUID, BigDecimal, etc.)
  to OpenAPI schema dicts.

• merge_params() enrichment — existing entries are now enriched with
  missing fields from incoming entries (not just skipped).

• Path parameter schema — auto-detected {param} path variables now
  include schema: {type: string}.

[prabhu]

Should we merge AppThreat/atom#243 before this PR? Also will atom-tools continue to work with slices without the annotations?

[abdul-levo]

Should we merge AppThreat/atom#243 before this PR? Also will atom-tools continue to work with slices without the annotations?

Yes @prabhu it's dependent PR , donot merge it now I am making some refinements I'll let you know once I am done
and yes Yes, it will continue to work without the annotations for Python, JS/TS, Ruby, Scala but for Java/Spring HTTP method (GET/POST/etc.), path params, request body, and class-level URL prefixes all come from annotations. Without them, the core regex path on method signatures produces little for typical Spring methods

[abdul-levo]

Should we merge AppThreat/atom#243 before this PR? Also will atom-tools continue to work with slices without the annotations?

Yes @prabhu it's dependent PR , donot merge it now I am making some refinements I'll let you know once I am done and yes Yes, it will continue to work without the annotations for Python, JS/TS, Ruby, Scala but for Java/Spring HTTP method (GET/POST/etc.), path params, request body, and class-level URL prefixes all come from annotations. Without them, the core regex path on method signatures produces little for typical Spring methods

@prabhu refinements are done . Please review i think we are good to go .

[abdul-levo]

Hi @prabhu #72 is the latest PR containing all refinements and changes and its a dependent PR of AppThreat/atom#243 and AppThreat/atom#244 please review #72 . I’m closing PR #71 and #70 since they are no longer up to date.