Validate OIDC /.well-known/openid-configuration metadata for HTTPS issuer, JWKS URI, and asymmetric signing algorithms.