fix(api): don't scope serializer querysets by AnonymousUser during schema generation

[Maffooch]

[sc-13920]

What

Fixes OpenAPI schema generation crashing when the Finding / import serializers are introspected with an unauthenticated request.

Why

The Finding serializer (dojo/finding/api/serializer.py) and the import serializer (dojo/api_v2/serializers.py) scope their endpoint/location PrimaryKeyRelatedField querysets to request.user. During OpenAPI schema generation drf-spectacular builds serializers with an AnonymousUser request. AnonymousUser is truthy, so the if user branch called get_authorized_*(user=AnonymousUser), and filtering a PK field by the AnonymousUser instance raised:

Field 'id' expected a number but got <AnonymousUser object>

drf-spectacular then ignored the affected views (FindingViewSet/importers), which produced an operationId "findings_retrieve" collision and a KeyError: 'content' in the prefetch postprocessing hook — breaking schema-integrity tests for downstream (Pro) consumers.

Fix

Treat an unauthenticated user as "no user" so the field falls back to an empty queryset, matching the prior behavior for anonymous / schema-time contexts:

if user is not None and not user.is_authenticated:
    user = None

Applied at both scoping sites.

Verification

Generated the full OpenAPI schema and ran the schema-integrity suite: no schema-generation errors/warnings, no operationId collisions, no prefetch KeyError; full mock-based unit phase green (15,441 passed).

🤖 Generated with Claude Code