Lessons learned from `oapi-codegen`'s time in the GitHub Secure Open Source Fund