openapi3: resolve refs under a header's content - #1424

resolveHeaderRef resolves a header's schema but never looks at its content, while resolveParameterRef walks both. So whatever sits under a header's content stays as it was decoded.

A $ref there is never followed, and a valid document fails Validate:

paths:
  /x:
    get:
      responses:
        '200':
          description: d
          headers:
            h:
              content:
                application/json:
                  schema: {$ref: '#/components/schemas/S'}
components:
  schemas:
    S: {type: string}

invalid paths: invalid path /x: invalid operation GET: header content is invalid: found unresolved ref: "#/components/schemas/S"

A null sub-schema there (a property with no value, for instance) also gets through. Anywhere else the loader refuses it with invalid schema: value MUST be an object, but under a header's content it stays a nil *SchemaRef, and Validate panics on it with a nil pointer dereference in (*SchemaRef).validateExtras. I found this one by fuzzing LoadFromData followed by Validate.

This walks content in resolveHeaderRef with resolveMediaTypeRefs, the same loop resolveParameterRef already has.

Added TestLoaderResolvesHeaderContent for the $ref and TestLoaderRejectsNullSchemaInHeaderContent for the null. Both fail on master. go test ./..., go vet, go generate, maps.sh and docs.sh are clean.

Prepared with Claude Code.