The OpenAPI overlays spec mandates the use of JSONPath as specified by RFC 9535, which allows filters without surrounding parentheses:
But the JSONPath library (jsonpath-plus) used by this project currently used by openapi-format requires parentheses:
$.security[?(@.cookieAuth)]