Authorization Server and Credential Issuer must support metadata

[paulbastian]

Closes #180

[awoie]

Making the same comment as @charsleysa that it would be good to mandate scopes in metadata for interop reasons even if it means there is some duplication if scopes are defined at the ecosystem level out-of-band.

[c2bo]

Just to be clear: Is the intention is for both (AS, Issuer) metadata to be made available via .well-known path?
If so, we should make that a bit clearer imho - otherwise it could be interpreted as metadata can also be provided out of band (but metadata is still supported).

[Sakurann]

per christian's comment - clarified that for the issuer metadata .well-known must be used. made suggestions

[Sakurann]

Just to be clear: Is the intention is for both (AS, Issuer) metadata to be made available via .well-known path?

yes

If so, we should make that a bit clearer imho - otherwise it could be interpreted as metadata can also be provided out of band (but metadata is still supported).

suggested text for issuer endpoint. AS already mandates .well-known in the rfc so i think no action there