Correct security definition to indicate the API requires OAuth2 authentication

[PatrickHofman]

This is a small change to the Swagger definition, but it allows consumers to see the API uses the OAuth2 code grant flow for its authorization, opposed to the vague 'apikey' Open API security type.