openapi: the six positions #235 listed still report resolution failures unsited

[OmarAlJarrah]

Summary

#235 asked for reference-resolution failures to name a site, and listed six positions whose
only report is the unsited one: pathItem, parameter, response, requestBody,
header, callback. It closed as completed with #273, which sited the security-reference
positions. The six it named did not move, so its own reproduction still holds.

Reproduction

Verified at 08614f3:

openapi: 3.1.0
info: {title: t, version: '1'}
paths:
  /a:
    $ref: '#/components/pathItems/Missing'
  /b:
    get:
      operationId: g
      parameters: [{$ref: '#/components/parameters/Missing'}]
      responses:
        '200': {$ref: '#/components/responses/Missing'}

$ morphic compile six.yaml 2>&1 >/dev/null | sed 's|.*six.yaml#||'
: not found -- struct is nil at /components/pathItems
: not found -- struct is nil at /components/parameters
: not found -- struct is nil at /components/responses

The other three behave identically:

paths:
  /c:
    post:
      operationId: p
      requestBody: {$ref: '#/components/requestBodies/Missing'}
      callbacks:
        cb: {$ref: '#/components/callbacks/Missing'}
      responses:
        '200':
          description: ok
          headers:
            H: {$ref: '#/components/headers/Missing'}

: not found -- struct is nil at /components/requestBodies
: not found -- struct is nil at /components/headers
: not found -- struct is nil at /components/callbacks

In the emitted document each of those carries "provenance": {"source": 0} — no pointer
field at all, so this is an absent site rather than an empty string.

Every pointer is empty across all six. Compare the security-scheme position, which #273 did
site:

$ morphic compile unres.yaml 2>&1 >/dev/null | sed 's|.*unres.yaml#||'
: not found -- key Missing not found in sequencedmap.Map
/components/securitySchemes/s: security scheme "s" has a $ref that resolves to nothing: ...

The second line is #273's sited report. The first is the resolve-phase one #235 is about, and
it is still unsited — for the security position too, where a sited report now stands beside it.

Why it matters

This is #235's own argument, unchanged: a document with several unresolvable references at
these positions produces several findings that all name the document and none the site, so
there is nothing to act on. #235 said explicitly that the unsited diagnostic "cannot simply
be dropped as a duplicate; it has to be replaced by a sited one" — at the six positions it
has no sited counterpart to be a duplicate of.

Notes

Three code comments cite #235 as live context for this behaviour
(internal/auth/auth.go, internal/auth/auth_test.go, internal/load/load.go), which is
accurate about what the compiler does but now points at a closed issue. They want
re-pointing at whatever tracks the remainder.

Found while reviewing #327, which is unaffected: it neither creates nor depends on this.