Catalog: exercise identifier identity with trailing-slash data

[RobertoIskandarani]

What

Extends three existing cases with trailing-slash data — no new case IDs, no restructuring:

• rfc9728-well-known-path-must-derive-from-resource-uri — adds "https://api.example.com/mcp/" to setup.resources, expecting "/.well-known/oauth-protected-resource/mcp": trailing slashes on the resource path are dropped when forming the well-known path.
• rfc8414-metadata-issuer-must-match-configured-issuer — adds a variant: configured https://auth.example.com, metadata issuer https://auth.example.com/ → reject. The metadata document is otherwise valid, so the rejection can only come from the issuer comparison.
• rfc9068-issuer-must-match — adds a variant: configured issuer https://auth.example.com/, token iss https://auth.example.com/ → accept.

The two issuer variants use a variants: list under setup with a per-item expected_outcome, following the shape error_scenarios already uses in rfc6750-error-response-must-map-error-codes.

Why

Two distinct rules were previously conflated, and neither had trailing-slash test data:

Well-known derivation normalizes. The PRM well-known path drops trailing slashes on the resource path, so https://api.example.com/mcp and https://api.example.com/mcp/ resolve to the same metadata document. Without this, two spellings of the same resource would each demand their own well-known route, and a client that appends or strips a slash would 404 on discovery. The case now pins the normalized derivation and the requirement summary states it explicitly.

Identifier comparison does not. RFC 9728 §3.3 and RFC 8414 §3.3 require the advertised resource/issuer to be identical to the configured value ("If these values are not identical, the data contained in the response MUST NOT be used"), an exact-string comparison that exists to defeat metadata substitution. RFC 3986 §6.2.3's "an empty path is equivalent to '/'" is a comparison technique a consumer may use — equivalent is not identical, and these specs chose simple string comparison. Both amended issuer cases are critical and already state exactness in their requirement_summary; only their test data failed to exercise it.

The accept variant also pins the sharpest consequence of over-normalizing: an SDK that strips a configured trailing-slash issuer before comparing it against a token's iss rejects every valid token from that authorization server.

Validation

• make check passes (yamllint + validate_catalog.py, 104 cases).
• make format (yamlfix) leaves the file unchanged.