Update location-verification.yaml for Spring25

[jlurien]

What type of PR is this?

• enhancement/feature

What this PR does / why we need it:

Updates location-verification API with the changes derived from Commonalities and ICM updates
x-camara-guidelines: 0.5.0

Which issue(s) this PR fixes:

Fixes #276, #277

Special notes for reviewers:

There are still some open discussions in Commonalities that may impact this PR, so we will keep it open until there is a final version for x-camara-guidelines: 0.5.0

Changelog input

* Error schemas updated with enums
* Some error status and codes have been updated
* Section with guidelines about how to identify the device from access token and request body has been updated 

Additional documentation

[github-actions]

🦙 MegaLinter status: ✅ SUCCESS

Descriptor	Linter	Files	Fixed	Errors	Elapsed time
✅ ACTION	actionlint	2		0	0.03s
✅ OPENAPI	spectral	3		0	4.91s
✅ REPOSITORY	git_diff	yes		no	0.01s
✅ REPOSITORY	secretlint	yes		no	0.8s
✅ YAML	yamllint	3		0	0.71s

See detailed report in MegaLinter reports

MegaLinter is graciously provided by

[alpaycetin74]

is it possible to explain the difference between "authentication is no longer valid" and "expired credentials" in more detail ?

[jlurien]

There is an issue in Commonalities to discuss this: camaraproject/Commonalities#368

IMO, UNAUTHENTICATED is the most generic one, which would cover all cases where the access token is not longer valid (typically because it is expired). AUTHENTICATION_REQUIRED is more specific, when a full new authentication from scratch is needed. But we could use the generic one and rely on the message for further description.

[bigludo7]

LGTM

[jlurien]

• Test plan should be updated in the same PR

[jlurien]

@bigludo7 @maxl2287

I have updated the PR with new changes:

• Updated the test plan. For that I have copied the fixed version of the test plan artifact in Commonalities, now still proposed as PR, but likely to be merged. We would probably need to apply as well to location-retrieval and check what applies to geofencing

• From the spec, I have already removed 403 INVALID_TOKEN_CONTEXT, and 401 AUTHENTICATION_REQUIRED. Discussions around this are not fully closed but it seems this will be the consensus.

• Also applied the fix on the note about networkAccessIdentifier support

[bigludo7]

One small comment on the test definition else good for me.

[bigludo7]

We should probably add: And the header "Authorization" is set to a valid access token which does not identify a single device

[jlurien]

Yes, you are right, but this is copied from Commonalities artifact, so I will have to update there as well

[bigludo7]

LGTM