Add OIDC issuer validation

[Avery-Dunn]

Adds new validation according to: https://identitydivision.visualstudio.com/Engineering/_workitems/edit/3268768

The issuer returned by the call to the OIDC endpoint (.well-known/openid-configuration) is valid if one of the following is true:

• It exactly matches the authority URL
• It has a known Microsoft host (e.g., login.microsoftonline.com)
• It has the same scheme and host as the authority (path can be different)
• For CIAM, the issuer follows the pattern of {tenant}.ciamlogin.com, even when using a custom domain

The validation behavior was added to authority.py, and new tests were added to test_authority.py to cover it

In addition, a few other tests in test_authority.py and test_application.py were given valid issuers in their mocked OIDC discovery responses in order to pass validation, but were otherwise unchanged.

(this is the full implementation of the work started in this draft PR: #830)

[rayluo]

We are discussing in this offline conversation on Teams.

[bgavrilMS]

@rayluo - any updates on this?

[Avery-Dunn]

@rayluo Any updates on this? A while back you had some behaviors you wanted to confirm or edge cases you wanted to test, and @4gust updated this PR to handle validating region-specific endpoints, but I can't remember what was still blocking this.

[bgavrilMS]

Need another rule for regiona.