Trust discovered OIDC endpoints; drop discoveryUrl

Scope the issuer-origin pin to only the endpoints the untrusted
/settings response advertised. Endpoints discovered from the issuer's
own .well-known are fetched out-of-band from the pinned origin and are
authoritative for wherever the issuer hosts them, so they are no longer
forced onto the issuer's origin. This lets an identity provider that
serves its endpoints off the issuer origin - Google, Azure AD - sign in
through discovery with an issuer pin. The co-location check (token and
device share one origin) still applies to every endpoint, and a
/settings-advertised endpoint is still origin- and path-pinned.

Remove the DiscoveryOptions.discoveryUrl pin: an issuer already drives
.well-known discovery, so it was redundant. With it go its self-issuer
check, its origin-derivation, the discoverFromIdp parameter, and the
now-unused issuer field in the discovery-document parser.

Add a test for the off-origin discovered-endpoint case and drop the
four discoveryUrl tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: glasstiger