Fix OAuth discovery rejecting a trailing-slash issuer or resource

[lukasedw]

An MCP server that delegates to Google lists authorization_servers: ["https://accounts.google.com/"], while Google's /.well-known/oauth-authorization-server answers issuer: "https://accounts.google.com", so the exact comparison in validate_server_metadata! rejects it.

On the resource side, OAuthProvider.normalize_url (oauth_provider.rb:18) strips a root / from server_url, so the expected resource is always https://host, and a server that answers resource: "https://host/" is rejected by validate_resource_metadata! the same way.

Both methods now treat an empty path and / as equal (RFC 3986 6.2.3), and nothing else: a different host, port or non-root path is still rejected.

Part of #133 (the issuer trailing slash). The resource prefix match is left out.

[lukasedw]

what do you think about this @NielsKSchjoedt @newstler?

[patvice]

Thanks @lukasedw, thanks for this change! I pushed a small follow-up commit (85fb5c3) to simplify the comparison.

Ruby's URI#normalize already does scheme-based normalization, so uris_match? is now just URI.parse(a).normalize == URI.parse(b).normalize.

As a bonus, it also accepts scheme/host case and explicit default-port differences (e.g. https://host:443). OAuthProvider.normalize_url already strips those from the expected resource, so they could still have caused false mismatches. Non-root trailing slashes (/tenant1/ vs /tenant1) are still rejected as before. I also added a few unit specs for uris_match?. Your original tests all pass unchanged.

Going to merge this now

[lukasedw]

@patvice awesome! Thanks!