Two Is a Crowd? A Black-Box Separation of One-Wayness and Security under Correlated Inputs