Catalog: exercise identifier identity with trailing-slash data

[RobertoIskandarani]

What

Extends three existing cases with trailing-slash data — no new case IDs, no restructuring:

• rfc9728-well-known-path-must-derive-from-resource-uri — adds "https://api.example.com/mcp/" to setup.resources, expecting "/.well-known/oauth-protected-resource/mcp/".
• rfc8414-metadata-issuer-must-match-configured-issuer — adds a variant: configured https://auth.example.com, metadata issuer https://auth.example.com/ → reject. The metadata document is otherwise valid, so the rejection can only come from the issuer comparison.
• rfc9068-issuer-must-match — adds a variant: configured issuer https://auth.example.com/, token iss https://auth.example.com/ → accept.

The two issuer variants use a variants: list under setup with a per-item expected_outcome, following the shape error_scenarios already uses in rfc6750-error-response-must-map-error-codes.

Why

RFC 9728 §3 and RFC 8414 §3 form the well-known URL by inserting the well-known path segment between the host and the path of the identifier — a pure string insertion with no normalisation step. RFC 9728 §3.3 and RFC 8414 §3.3 then require the advertised resource/issuer to be identical to the configured value ("If these values are not identical, the data contained in the response MUST NOT be used"), an exact-string comparison that exists to defeat metadata substitution. RFC 3986 §6.2.3's "an empty path is equivalent to '/'" is a comparison technique a consumer may use — equivalent is not identical, and these specs chose simple string comparison.

Both amended issuer cases are critical and already state exactness in their requirement_summary; only their test data failed to exercise it — none of the existing inputs carried a trailing slash, so implementations could normalise identifiers without any case going red. This closes that coverage gap; it introduces no new requirement.

The accept variant also pins the sharpest consequence of normalising: an SDK that strips a configured trailing-slash issuer before comparing it against a token's iss rejects every valid token from that authorization server.

Validation

• make check passes (yamllint + validate_catalog.py, 104 cases).
• make format (yamlfix) leaves the file unchanged.