Consolidate registration endpoint synthesis into pkg/oauthproto

[amirejaz]

Context

PR #5357 added an endpoint synthesis block in resolveDCRCredentials (pkg/auth/discovery/discovery.go:737-745) to handle the ErrRegistrationEndpointMissing case when re-fetching AS metadata. This logic duplicates synthesiseRegistrationEndpoint in pkg/auth/dcr/resolver.go:1020-1033, which is unexported and unreachable from pkg/auth/discovery.

The duplication was called out as a non-blocking nit during review of #5357. Both sites implement the same nanobot/Hydra convention: build {issuer}/register by joining the issuer's scheme, host, and trimmed path with /register.

Problem

Two identical implementations of the same URL construction rule will drift if either site is updated (e.g. scheme/host validation is added to one, or the convention changes). There is no test that the two sites produce identical output for the same input.

Proposed fix

1. Move synthesiseRegistrationEndpoint (or an equivalent) to pkg/oauthproto, the natural home for AS URL construction utilities alongside FetchAuthorizationServerMetadata and buildDiscoveryURLs.
2. Update both call sites — pkg/auth/dcr/resolver.go and pkg/auth/discovery/discovery.go — to use the shared function.
3. Add a test asserting both callers produce identical results for the same issuer input.

This work is a natural companion to the larger follow-up of threading code_challenge_methods_supported through AuthServerInfo (also noted in #5357), which would eliminate the re-fetch in resolveDCRCredentials entirely and with it the second call site.

References

• Fix DCR failure for authorization servers with non-root issuer paths #5357 (introduced the duplication, fix for v0.28.0 regression: DCR fails for issuers with non-root paths #5356)
• pkg/auth/dcr/resolver.go:1020 — synthesiseRegistrationEndpoint
• pkg/auth/discovery/discovery.go:737 — duplicate inline block