Sync and vendor upstream OpenAPI Spec weekly

[gaelsimon]

What?

Vendors the specs that other services publish at https://api.woosmap.com/<name>/openapi.json into upstream/, and builds the merged spec from those files instead of downloading them at build time. A weekly workflow (sync-upstream-specs.yml) refreshes them with tools/sync-upstream-specs.sh and opens or updates a single fix(spec): sync upstream OpenAPI specs PR when they change.

Why?

The merged spec only picked up upstream changes when an unrelated commit triggered a release, so the published spec has drifted since 1.45.0 and whichever PR builds next ships those changes unreviewed. Vendoring makes builds reproducible and turns each upstream change into a reviewable diff. This PR brings upstream/ up to date, so the next release includes the upstream changes since 1.45.0, among them mode on /distance/tolls/json/ now limited to driving.

How to test

npm run build && npm test: the merged spec is identical to the one built from a live download. npm run sync:upstream leaves upstream/ untouched as long as the upstream specs don't change. After merge, run the workflow once from the Actions tab.

[wgsadmin]

Review summary:

• Should fix: The vendored Localities spec is already stale versus the current upstream endpoint. Refreshing it before merge keeps this PR's release from publishing an outdated Localities contract.

I also checked the PR metadata, latest Actions run for the head SHA, the Bazel/workflow wiring, JSON validity for the vendored specs, and git diff --check.

[wgsadmin]

Running bash tools/sync-upstream-specs.sh against the current upstream endpoint changes this file from v25.8.0 to v25.8.3, and also adds the new documented special-character / punctuation behavior for the input and address query parameters. If this PR is merged as-is, the next release still publishes an outdated Localities contract even though the goal is to vendor the current upstream state. Could you refresh upstream/localities.json with npm run sync:upstream before merge?

[gaelsimon]

Refreshed in 3ed73ab: upstream/localities.json is now v25.8.3, the other upstream specs had not changed. Upstream keeps moving after merge, which the weekly sync workflow picks up.