fix: correct resolver configuration merge in ValidationService

[Kartikayy007]

Description

Fixes external file resolution via $ref that broke in v3.3.0. The issue was caused by incorrect object spread order in the ValidationService constructor.

Problem:
I believe after PR #1875 adding the custom resolver support, the spread of parserOptions.__unstable?.resolver was overwriting the custom resolvers array that was breaking local file reference resolution causing bug.

BEFORE (bug):

__unstable: {
  resolver: {
    resolvers: [createHttpWithAuthResolver(), ...]  // Was added
  },
  ...parserOptions.__unstable?.resolver,  // Overwrites above
}

Solution:
Reordered spreads so base config is spread first, then custom resolvers are set last:

AFTER (fixed):

__unstable: {
  ...parserOptions.__unstable,
  resolver: {
    ...parserOptions.__unstable?.resolver,
    resolvers: [createHttpWithAuthResolver(), ...]  // Set last
  }
}

Testing:

• Done All existing tests pass (200 passing)
• Local file references now resolve correctly
• GitHub resolver with auth still works

Related issue(s)

Fixes #1839

[changeset-bot]

🦋 Changeset detected

Latest commit: 7f8ad5e

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@asyncapi/cli	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

Changeset has been generated for this PR as part of auto-changeset workflow.

Please review the changeset before merging the PR.

---
'@asyncapi/cli': patch
---

fix: correct resolver configuration merge in ValidationService

- 29c22f1: fix: correct resolver configuration merge in ValidationService

Fixes #1839
- b4529e5: test: add regression test for resolver config merge bug
- 8246049: test: add integration test for external file reference resolution

If you are a maintainer or the author of the PR, you can change the changeset by clicking here

Tip

If you don't want auto-changeset to run on this PR, you can add the label skip-changeset to the PR or remove the changeset and change PR title to something other than fix: or feat:.

[Shurtu-gal]

Thanks for finding the root cause @Kartikayy007. Could you possibly add a test targeting #1839 so that such scenarios don't happen later?

[Kartikayy007]

Thanks for finding the root cause @Kartikayy007. Could you possibly add a test targeting #1839 so that such scenarios don't happen later?

ready for another review @Shurtu-gal

[Shurtu-gal]

@Kartikayy007 What I meant was having a set of asyncapi files with refs between them. That should provide us good sense of security.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Kartikayy007]

@Shurtu-gal please review, also please take a look at #1887 whenever you get time

[Shurtu-gal]

LGTM