Add requirements or recommendations about allow/deny lists for reference target retrieval re-use: ref/id resolution how $ref, operationId, or anything else is ...