profile.yaml: force sending access token on all requests

...to make sure those don't end up with 403 in cases like
quotient-im/libQuotient#797

data/api/client-server/profile.yaml

@@ -75,6 +75,9 @@ paths:
         own displayname or to query the name of other users; either locally or
         on remote homeservers.
       operationId: getDisplayName
+      security:
+        - accessTokenQuery: []
+        - accessTokenBearer: []
       parameters:
         - in: path
           name: userId
@@ -178,6 +181,9 @@ paths:
         own avatar URL or to query the URL of other users; either locally or
         on remote homeservers.
       operationId: getAvatarUrl
+      security:
+        - accessTokenQuery: []
+        - accessTokenBearer: []
       parameters:
         - in: path
           name: userId
@@ -229,6 +235,9 @@ paths:
         to fetch the user's own profile information or other users; either
         locally or on remote homeservers.
       operationId: getUserProfile
+      security:
+        - accessTokenQuery: []
+        - accessTokenBearer: []
       parameters:
         - in: path
           name: userId