fix: add missing signature response headers to get_order (#370)

The get_order operation was the only REST endpoint missing
Signature, Signature-Input, and Content-Digest response headers.
All other operations (checkout, cart, catalog, get_product) already
declare these headers, enabling codegen tools to surface signature
verification and signaling to implementors that responses should
be signed per the signatures spec.

Closes #364

Made-with: Cursor

Co-authored-by: Federico D'Amato <damaz@google.com>

Author: ynachiket

source/services/shopping/rest.openapi.json

@@ -673,6 +673,11 @@
         "responses": {
           "200": {
             "description": "Order retrieved or business outcome message",
+            "headers": {
+              "Signature": { "$ref": "#/components/headers/signature" },
+              "Signature-Input": { "$ref": "#/components/headers/signature_input" },
+              "Content-Digest": { "$ref": "#/components/headers/content_digest" }
+            },
             "content": {
               "application/json": {
                 "schema": { "$ref": "#/components/schemas/order_response" }