6.0.1: `new URL()` drops issuer path when building the OIDC discovery URL

[RyanGallagher44]

Describe the bug

In 6.0.1 (#109), discovery construction changed from string concatenation to new URL(): Issuer.discover((new URL('/.well-known/openid-configuration', issuer)).href).

A path that starts with / is treated as absolute, so the issuer’s path is replaced instead of appended.

Reproduction Steps?

1. Install @okta/oidc-middleware@6.0.1.
2. Create ExpressOIDC with a custom authorization server issuer:

const { ExpressOIDC } = require('@okta/oidc-middleware');
const oidc = new ExpressOIDC({
  issuer: 'https://{yourOktaDomain}/oauth2/default',
  client_id: '{clientId}',
  client_secret: '{clientSecret}',
  appBaseUrl: 'https://{yourDomain}',
});
oidc.on('error', err => console.error(err));

3. Observe the discovery request (or the error event). The client requests https://{yourOktaDomain}/.well-known/openid-configuration instead of https://{yourOktaDomain}/oauth2/default/.well-known/openid-configuration

SDK Versions

@okta/oidc-middleware: 6.0.1
Node: 20+
Regression vs: 6.0.0 / 5.5.1

Additional Information

No response