openapi2kong: OpenAPI requires multiple OIDC scopes, but generated openid-connect plugin configuration requires only one scope

[bhollingworth]

Using deck v1.66.1 on Linux amd64, with the following command line:
deck file openapi2kong --generate-security --spec openapi.yaml
and the following openapi.yaml file:

openapi: 3.0.4
info:
  title: example
  version: 1.2.0
servers:
  - url: https://example.com
paths:
  /oidc:
    get:
      security:
        - OpenIDConnect: # The intent is that both of the below scopes should be required to execute this operation
          - example:list
          - example:read        
      responses:
        '204':
          description: No content
components:
  securitySchemes:
    OpenIDConnect:
      type: openIdConnect
      openIdConnectUrl: https://example.com/.well-known/openid-configuration

Note that the OpenAPI 3.0.4 specification states the following about scopes in the Security Requirement Object:

If the security scheme is of type "oauth2" or "openIdConnect", then the value is a list of scope names required for the execution

My intent is that both scopes will be required, and I expect that the generated openid-connect plugin configuration will use a logical AND check for these scopes. However, the generated openid-connect plugin configuration uses a logical OR check, meaning that only one of the scopes is required to execute the operation.

_format_version: "3.0"
services:
- host: example.com
  id: 730d612d-914b-5fe8-8ead-e6aa654318ef
  name: example
  path: /
  plugins: []
  port: 443
  protocol: https
  routes:
  - id: b6aac907-cf6d-50d7-8290-80878a483a64
    methods:
    - GET
    name: example_oidc_get
    paths:
    - ~/oidc$
    plugins:
    - config:
        issuer: https://example.com/.well-known/openid-configuration
        scopes_required:
        - example:list
        - example:read
      name: openid-connect
    regex_priority: 200
    strip_path: false
    tags: []
  tags: []
upstreams: []

According to the OpenID Connect plugin documentation, the scopes_required config field needs to be generated as follows to use a logical AND check:

        scopes_required:
        - example:list example:read