Define strict return value typing for Depends and Security

[JaniM]

Depends can be used with a direct form, which although not recommended, is still supported. The following code is problematic wrt. type checking.

def dependency() -> str:
    return "dependency"

@router.get("/")
def endpoint(value: int = Depends(dependency)):
    pass

Currently, Depends(dependency) returns Any, which then happily gets assigned to the int. This patch changes it to return a type matching what the dependency returns, making the above code fail type checking with mypy as it should.

[JaniM]

I didn't touch Security, as I have never used it. Wasn't sure if it's used the same way or has different requirements.

Edit: Made the change.

[JaniM]

The checks seem to be stuck, can someone give them a nudge?

[jsimonlane]

Good fix! Hoping this gets merged soon...