go.mod: bump github.com/getkin/kin-openapi to v0.131.0

As deepmap/oapi-codegen didn't work with this newer version, upgrade to
oapi-codegen/oapi-codegen v2.

Mitigating CVE-2025-30153

vendor/github.com/oapi-codegen/runtime/jsonmerge.go

@@ -0,0 +1,34 @@
+package runtime
+
+import (
+	"encoding/json"
+
+	"github.com/apapsch/go-jsonmerge/v2"
+)
+
+// JsonMerge merges two JSON representation into a single object. `data` is the
+// existing representation and `patch` is the new data to be merged in
+//
+// Deprecated: Use JSONMerge instead.
+func JsonMerge(data, patch json.RawMessage) (json.RawMessage, error) {
+	return JSONMerge(data, patch)
+}
+
+// JSONMerge merges two JSON representation into a single object. `data` is the
+// existing representation and `patch` is the new data to be merged in
+func JSONMerge(data, patch json.RawMessage) (json.RawMessage, error) {
+	merger := jsonmerge.Merger{
+		CopyNonexistent: true,
+	}
+	if data == nil {
+		data = []byte(`{}`)
+	}
+	if patch == nil {
+		patch = []byte(`{}`)
+	}
+	merged, err := merger.MergeBytes(data, patch)
+	if err != nil {
+		return nil, err
+	}
+	return merged, nil
+}