- Extract strip_secret_refs as module-level function for reuse
- Add secret-aware validation to stream_check_schema
- Handle scalar array items (string arrays with secret refs)
- Fix test: add no_shuffle(), remove unused require, improve assertions

Instead of bypassing plugin_obj.check_schema() entirely when secret
refs are detected, move the strip logic into core.schema.check().
This preserves all custom code validation in each plugin's
check_schema (regex_uri compilation, headers checks, group field
validation, claim_schema, etc.) while only bypassing jsonschema
constraints for the specific fields containing secret references.

- Handle anyOf/oneOf/allOf at property level for string type detection
- Recurse into object-typed branches of anyOf/oneOf/allOf
- Adjust minItems when stripping secret ref elements from arrays
- Add warning log when secret resolution fails
- Add code comment explaining stable reference cache rationale
- Remove empty more_headers directive in test

- Adjust minProperties when stripping object properties (fixes
  proxy-rewrite and nested object validations)
- Extend strip_required to handle if/then/else conditional schemas
  (fixes SSL cert/key secret ref validation)

openid-connect check_schema requires either bearer_only=true or
session.secret to be set.

- Rename TEST 8/9 to match actual assertions
- Add TEST 11: limit-count redis_host as env ref exercises if/then
  conditional required stripping
- Renumber old TEST 11 to TEST 12

When core.schema.check() validates a copy of the json (to strip
secret ref fields before jsonschema validation), the validator sets
default values on the copy but not the original. This caused:
- upstream.scheme defaulting to nil instead of 'http' (balancer crash)
- plugin defaults like redis_database not being set
- SSL and other resource defaults being lost

Add merge_defaults() to copy newly-set fields from the validated copy
back to the original json after successful validation.

…handle dependencies keyword

- has_secret_ref and collect_secret_values now use a visited set to
  prevent stack overflow on tables with circular references
- strip_required now recurses into 'dependencies' keyword to handle
  schemas like jwt-auth that use dependencies.field.oneOf[].required

Several plugins perform Lua-level validation in check_schema that
would reject $secret:// or $env:// reference strings:
- jwt-auth: base64 decode of secret
- response-rewrite: base64 decode of body
- proxy-rewrite: regex compilation of regex_uri elements
- redirect: regex compilation of regex_uri elements
- ai-proxy: JSON decode of gcp service_account_json
- ai-proxy-multi: JSON decode of gcp service_account_json
- openid-connect: jsonschema compilation of claim_schema
- request-validation: schema validation of body_schema/header_schema

Add is_secret_ref() guard before each check so secret reference
strings pass through check_schema and get resolved at runtime.

…lidation hook

Replace the complex schema stripping approach (deepcopy + strip_secret_refs +
strip_required + merge_defaults, ~180 lines) with a single skip_validation
hook in jsonschema. The hook tells the validator to accept secret reference
strings as-is, bypassing type/enum/format/pattern constraints since they
will be resolved at runtime.

Also bump jsonschema dependency from 0.9.9 to 0.9.13 which adds the
skip_validation feature.

The jsonschema skip_validation hook now passes (value, schema) instead of
just (value). Update is_secret_ref to accept the schema parameter.
Also fix stale test descriptions referencing old 'stripping' approach.

The skip_validation hook should only bypass validation when the schema
expects a string type. For non-string fields (integer, boolean, etc.),
secret ref strings are not allowed at schema validation time.

For string-typed schemas, only skip validation if the value would fail a
constraint (enum, pattern, minLength, format). This prevents breaking
oneOf validators (like SSL key/cert) where one branch already accepts
secret ref patterns natively.

For non-string schemas (integer, boolean, etc.), always skip since a
string secret ref would fail the type check.

The jsonschema skip_validation hook now handles secret references
automatically, making the oneOf workaround in SSL cert/key fields
unnecessary. Simplify is_secret_ref to a straightforward prefix check.

Also update secret docs to describe the full supported scope:
- All plugin config string fields
- SSL cert/key/certs/keys fields
- Consumer auth config string fields

Only skip validation when the schema declares type='string' or has no
explicit type constraint. Fields with type='object', 'integer', etc.
will no longer be bypassed even if the value looks like a secret ref.

In redirect.lua and proxy-rewrite.lua, still validate the regex pattern
when only the replacement is a secret ref (using empty string as test
replacement). Only skip validation when the pattern itself is a secret ref.

Workflow plugin calls action handlers directly, bypassing plugin.filter()
where central secret resolution happens. Add fetch_secrets() in workflow
handlers for limit-conn and limit-count to ensure secret refs are resolved
when these plugins are used as workflow actions.

This reverts commit e31c069.

fetch_secrets() always returns a table when given a table input, so the
nil check was unreachable dead code.

Add _no_secret_ref weak-keyed cache so configs without secret refs are
only scanned once. Subsequent requests skip has_secret_ref() entirely.