Adds new validation according to: https://identitydivision.visualstudio.com/Engineering/_workitems/edit/3268768

The issuer returned by the call to the OIDC endpoint (.well-known/openid-configuration) is valid if one of the following is true:

• It exactly matches the authority URL
• It has a known Microsoft host (e.g., login.microsoftonline.com)
• It has the same scheme and host as the authority (path can be different)
• For CIAM, the issuer follows the pattern of {tenant}.ciamlogin.com, even when using a custom domain

The validation behavior was added to authority.py, and new tests were added to test_authority.py to cover it

In addition, a few other tests in test_authority.py and test_application.py were given valid issuers in their mocked OIDC discovery responses in order to pass validation, but were otherwise unchanged.

(this is the full implementation of the work started in this draft PR: #830)