[Feature Request]: Skip discovery when endpoints are fully provided

[khalic-lab]

Is your feature request related to a problem? Please describe.

Yes. When using IDPs that:

1. Don't expose .well-known/openid-configuration due to CORS restrictions
2. Are behind a WAF/Gateway that blocks discovery endpoints
3. Have non-standard discovery URLs
4. Are in environments where the discovery endpoint is unreachable from the browser

The library currently always attempts to fetch .well-known, even when authWellknownEndpoints is fully configured. This causes errors like:

Access to XMLHttpRequest at 'https://idp.example.com/.well-known/openid-configuration' has been blocked by CORS policy

Describe the solution you'd like

Option A: Explicit flag

  {
    skipDiscovery: true,  // New option
    authWellknownEndpoints: {
      issuer: '...',
      authorizationEndpoint: '...',
      tokenEndpoint: '...',
      // ...
    }
  }

Option B: Auto-detect

Skip discovery automatically if authWellknownEndpoints contains the minimum required endpoints (issuer, authorizationEndpoint, tokenEndpoint):

// In AuthWellKnownDataService.getWellKnownEndPointsForConfig()
const hasRequiredEndpoints = authWellknownEndpoints.issuer &&
    authWellknownEndpoints.authorizationEndpoint &&
    authWellknownEndpoints.tokenEndpoint;

if (hasRequiredEndpoints) {
    this.loggerService.logDebug(config, 'Skipping .well-known discovery - using provided endpoints');
    return of(authWellknownEndpoints);
}

Describe alternatives you've considered

1. Proxy the discovery endpoint, adds infrastructure complexity
2. Patch the library, not maintainable, breaks on updates
3. Use a different library, migration cost

Additional context

It's a common issue with enterprise IDPs behind security gateways. The endpoints static, but the .well-known endpoint isn't browser-accessible outside

Related issues:

• [Bug]: Wellknown endpoints completely overwrite the authWellknownEndpoints configuration #1983 (merge behavior bugs)
• OIDC well known config cannot be loaded from the app, but can be viewed in the browser.  #1267 (CORS blocking well-known)
• SPA Cors requests are blocked #1683 (SPA CORS requests blocked)

[khalic-lab]

I can provide a PR if the idea is approved