Add another well-known check

[npm1]

This PR enforces that accounts_endpoint and login_url are present in the well-known file whenever the client_metadata is used. Fixes #700

---

Preview | Diff

[npm1]

@togamid can you take a look?

[togamid]

It's currently very easy to miss. Maybe also add an "extension" box at the end of the IdP well-known section that says "If the config endpoint returns a client_metadata endpoint, accounts_endpoint and login_url are always required" (or something similar). As it is it is likely that people who just skim the browser part because they want to implement an IdP miss it and wonder why their implementation fails.

[npm1]

It's currently very easy to miss. Maybe also add an "extension" box at the end of the IdP well-known section that says "If the config endpoint returns a client_metadata endpoint, accounts_endpoint and login_url are always required" (or something similar). As it is it is likely that people who just skim the browser part because they want to implement an IdP miss it and wonder why their implementation fails.

Done. Requesting review from Chrome but also CC @bvandersloot-mozilla as this only impacts the extension