private OpenApi removeUnusedSecuritySchemes(OpenApi openapi) {
        // Determine which security schemes were actually used.
        Set<String> used = openapi.getSecurity()
                .stream()
                .flatMap(map -> map.keySet().stream())
                .collect(Collectors.toSet());

        for (PathItem path : openapi.getPaths().values()) {
            for (OperationObject operation : path.getOperations().values()) {
                for (Map<String, List<String>> entry : operation.getSecurity().orElse(Collections.emptyList())) {
                    used.addAll(entry.keySet());
                }
            }
        }

        // Find out if there are unused security definitions.
        Set<String> unused = new TreeSet<>(openapi.getComponents().getSecuritySchemes().keySet());
        unused.removeAll(used);

        if (unused.isEmpty()) {
            return openapi;
        }

        LOGGER.info("Removing unused OpenAPI security scheme definitions: " + unused);
        ComponentsObject.Builder componentsBuilder = openapi.getComponents().toBuilder();
        for (String unusedScheme : unused) {
            componentsBuilder.removeSecurityScheme(unusedScheme);
        }

        return openapi.toBuilder().components(componentsBuilder.build()).build();
    }
Removes unused components from the OpenAPI model.

<p>This plugin will take effect by default, but can be disabled by setting
"openapi.keepUnusedComponents" to true. Refs are removed in rounds until
a round of removals has no effect.

<p>TODO: This plugin currently only supports the removal of schemas and security schemes.
smithy-openapi/src/main/java/software/amazon/smithy/openapi/fromsmithy/mappers/RemoveUnusedComponents.java