fix(compilers/openapi): warn on a malformed path key

[fuad-daoud]

Summary

A Paths Object key that is not a path lowered in silence. "a/b c?x" reached
the IR with uriTemplate: "a/b c?x", no stderr output and exit 0 — as did
widgets (no leading slash), /a b, /a?x=1 and /a/%zz. The key still
lowers exactly as written; what this adds is one warning per malformed key, so
the typo is visible without any lowering changing (GitHub #641).

What a key may not be, and why:

• no leading / — the Paths Object Patterned Fields rule, stated in the
  same sentence at 3.0.3 §4.7.8.1, 3.1.0 §4.8.8.1 and 3.2.0 §4.8.1, so the
  check is not version-gated;
• a ? — RFC 3986 §3.4 keeps the query out of the path, and OpenAPI states
  query data as Parameter Objects with in: query;
• a character a URI path does not admit — RFC 3986 §3.3's pchar set plus
  / and OpenAPI's {} templating braces. Non-ASCII is admitted (the IR field
  is an RFC 6570 template, whose literals admit and pct-encode them), and % is
  admitted only as the start of a pct-encoded triplet.

The new openapi/invalid-path-key diagnostic is a warning, not an error:
the key does lower, so an error would be a refusal this compiler does not
perform, and harness.Check stops at the first error diagnostic, which would
hide every later finding in the same spec. It is sited at /paths/<key> by
ids.Ptr("paths", key), so the pointer is RFC 6901-escaped, and its message
names the key, every defect the key carries, and closes by saying the key is not
rewritten. One diagnostic per key, not per defect.

Deliberately out of scope, stated here and in the code:

• # is left to GitHub openapi: a path key with a URL fragment becomes a literal URI template #602, which will strip the fragment, set
  SharedRoute, regroup the operations and report the key itself. A warning
  from this code saying the key is lowered as written would be false the moment
  openapi: a path key with a URL fragment becomes a literal URI template #602 lands, so this code stays silent and the silence is pinned by a test.
• Webhook keys are names rather than paths, and callback keys are runtime
  expressions; Paths Object x-* extensions are not path items. All are
  left alone.

No existing diagnostic changed code, severity, message or pointer, and nothing
is deleted.

Test plan

• go test ./compilers/openapi/internal/operation -run TestPathKey -count=1 —
  TestPathKey_Defects (classifier table: every allowed and rejected class,
  %20/%2/%zz/trailing %, non-ASCII, ?, #, empty key),
  TestPathKeys_MalformedAreReported (one warning at /paths/<escaped>, the
  message naming each defect, URITemplate verbatim),
  TestPathKeys_ValidAreNotReported (overreach),
  TestPathKeys_MalformedUnderEveryVersion (3.0.3, 3.1.0, 3.2.0),
  TestPathKeys_FragmentIsSilentForNow,
  TestPathKeys_WebhookKeysAreNotPaths.
• go test ./compilers/openapi/... -count=1 — green, no golden regenerated and
  none changed (git status --porcelain -- '*.golden.json' is empty; no
  committed paths key in the corpus is malformed).
• make gate — exits 0, including the exact-100% coverage gate.
• Manual probe: go run ./cmd/morphic compile on a spec keyed a/b c?x prints
  one warning and still emits "uriTemplate": "a/b c?x", exit 0.

The plan this implements is committed alongside the fix as
docs/plans/641-malformed-path-key-warning.md.