Trailing-slash removal inadvertently dropped from Credential Issuer Metadata path construction (regression from #527)

Section 12.2.2 (Credential Issuer Metadata Retrieval) currently says:

Credential Issuers publishing metadata MUST make a JSON document available at the path formed by inserting the string /.well-known/openid-credential-issuer into the Credential Issuer Identifier between the host component and the path component, if any.

This is silent on what to do when the Issuer Identifier ends in /. RFC 8414 §3.1, which #527 aimed to align with, explicitly requires:

If the issuer identifier value contains a path component, any terminating "/" MUST be removed before inserting "/.well-known/" and the well-known URI suffix between the host component and the path component.

History

Prior to PR #527, the spec did include this rule ("any terminating / MUST be removed before appending..."). #527 rewrote the sentence to fix the insertion position (concatenate-at-end → insert between host and path, matching RFC 8414/8615), but the terminating-/ clause was dropped in the rephrase. The PR discussion only covered the worked example — the removal was not raised or I believe (as the PR author) was not intended.

Impact

For an identifier like https://issuer.example.com/tenant/, the current wording yields https://issuer.example.com/.well-known/openid-credential-issuer/tenant/, whereas RFC 8414's rule yields .../tenant. Different implementations may diverge.

Proposed fix

Restore the terminating-/ removal rule to §12.2.2 (and the 1.1 draft) to match RFC 8414 §3.1, e.g. append:

If the Credential Issuer Identifier contains a path component with a terminating /, the terminating / MUST be removed before inserting /.well-known/openid-credential-issuer.

Unfortunately this would technically be a breaking change I think, so requires some thought.

This got raised to the certification team under https://gitlab.com/openid/conformance-suite/-/work_items/1823