Implement RFC 9207 issuer validation in ClientOAuthProvider

[mikekistler]

Summary

Implements SEP-2468 — RFC 9207 issuer (iss) parameter validation in the OAuth authorization flow.

Closes #1571

Changes

• AuthorizationResult — New class that returns both the authorization code and the validated issuer URI from the authorization redirect.
• ClientOAuthProvider — Validates the iss parameter in authorization responses per RFC 9207, and validates that the authorization server metadata issuer field matches the expected URI per RFC 8414 Section 3.3.
• AuthorizationRedirectDelegate — Updated signature to return AuthorizationResult (containing issuer) instead of just a string code.
• AuthorizationServerMetadata — Added Issuer property.
• ClientOAuthOptions — Updated to accommodate the new authorization result type.
• Conformance client — Updated to pass issuer from query parameters.
• Tests — Updated OAuth tests for the new AuthorizationResult return type.

RFC 9207 Behavior

1. When the authorization server includes an iss parameter in the authorization response, the client validates it matches the expected authorization server issuer.
2. Authorization server metadata issuer is validated against the expected URI per RFC 8414 Section 3.3.
3. If validation fails, the client rejects the response with a descriptive error.

Known Issue

The auth/2025-03-26-oauth-metadata-backcompat conformance test currently fails because it expects the client to tolerate an issuer mismatch in legacy metadata discovery. This is an intentional strictness choice per RFC 8414 — we may need to relax validation for this specific backward-compatibility scenario depending on spec discussion.