OpenAPI spec's `ClientErrorResponse` etc are incorrect for most API routes

Starting point for making this more strict and hence actually useful for development:

diff --git a/openapi.yml b/openapi.yml
index a9b71ddfb..71b3a0321 100644
--- a/openapi.yml
+++ b/openapi.yml
@@ -2027,6 +2027,7 @@ components:
       required:
         - detail
         - source
+      additionalProperties: false
       properties:
         detail:
           type: string
@@ -2205,14 +2206,14 @@ components:
             type: object
             required:
               - errors
+            additionalProperties: false
             properties:
               errors:
                 type: array
                 description: Error items
+                minItems: 1
                 items:
-                  type: object
-                  schema:
-                    $ref: '#/components/schemas/Error'
+                  $ref: '#/components/schemas/Error'
     AuthenticationErrorResponse:
       description: Access denied response.
       content: