…-upgrade

Upgrade license to AGPL-3.0-or-later

Closes #5. Truly zero-dependency now:
- JWT sign/verify via crypto.subtle
- JWK thumbprint per RFC 7638
- Supports RS256, ES256, PS256 for token verification
- Remove jose from package.json
- Bump version to 0.0.7

- Validate exp/nbf claims with 60s clock skew tolerance
- Bump version to 0.0.7

Web Crypto spec requires { name: 'SHA-256' } not plain strings.

…-with-web-crypto

Replace jose dependency with Web Crypto API

Add detailed comparison with @inrupt/solid-client-authn-browser and
@inrupt/oidc-client showing size, dependencies, and build requirements.
Update badges and feature list for AGPL and Web Crypto.

)

Closes #7.

`solid-oidc.js` had three sites comparing `iss` / `issuer` URLs but only
one of them (the discovery-time check) normalized trailing slashes. The
redirect-callback check and the token-validation check used strict `!==`
with no normalization, so legitimate logins failed with misleading
"Issuer mismatch" errors any time the IdP served slightly different URL
forms between the discovery doc and the redirect / token claim.

Lift `trimSlash` to module scope and apply it consistently at all three
comparison sites. RFC 9207 §2.3 requires comparison after normalization.

Patch release including #7 / #8: normalize iss/issuer comparisons
consistently across all three RFC 9207 / Solid-OIDC validation sites
in solid-oidc.js.

…#12)

authFetch is the authenticated drop-in for fetch but was an unbound class method, so passing it by reference (rdflib Fetcher, solid-logic, rdf-dereference, or destructuring) lost the this binding and threw on this._isActive. Bind it in the constructor; add a test that destructures and calls it.