Warning: This build has drifted.
The coverage report for this pull request build may be inaccurate because its base commit is no longer the HEAD of its target branch.
This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

    • Learn more: For more information on this, see Tracking coverage changes for pull request builds.
    • Fix now: For a quick fix, rebase this PR at GitHub. Your next report should be accurate.
    • Prevent going forward: To avoid this issue with future PRs, see these Recommended CI Configurations.

spec: address IETF/OAuth/HTTP review findings

Applies the reviewer-flagged normative fixes to the draft:

- Resolve the RFC 9068 conformance contradiction: the access token is
  structured and validated as an RFC 9068 JWT access token with the self-issued
  deviations defined in Token Validation, instead of a blanket "follows the
  profile" that the minimal self-issued token cannot meet.
- Bind the verification key to the issuer: with multiple trusted issuers the
  signature MUST be verified only with key material for the token's iss, and iss
  validation is required whenever an authorization server is trusted (not only
  when advertised); self-issued-only hubs that skip iss MUST use a hub-unique
  aud.
- Define query-string parsing (application/x-www-form-urlencoded parser of the
  URL standard; constraints apply to decoded names/values) and reject the
  pre-1.0 `topic` parameter and invalid matcher values with 400.
- Name the reserved-namespace resolution algorithm (WHATWG URL parser, same as
  URL Pattern), require dot-segment removal, and define behavior for
  non-URL-reference topics.
- Require hubs to serialize multi-line `data` as one SSE data: field per line,
  note CR/CRLF normalization, and add `data` to the field-injection analysis as
  a security requirement.
- Make the HTML (Server-Sent Events) reference normative at every citation
  site.

Also: typ accepts application/at+jwt (RFC 7515 4.1.9); exp explicitly required;
error codes carried in the WWW-Authenticate challenge with resource_metadata on
all challenges; resource is REQUIRED (not SHOULD) in published metadata; add the
Well-Known Status field and use IESG as the mercure_cookie change controller;
cite RFC 7396 and JSON-LD 1.1 instead of the obsoleted RFC 7386 and JSON-LD 1.0.