## Summary
- Add an exported \`oauthex.MatchesResource(claims []string, resource
string) bool\` helper that compares an \`aud\` claim slice against an
expected resource URL with the canonical-form (trailing slash) tolerance
required by RFC 9728 and RFC 8707.
- Tests cover the common shape combinations (canonical/trimmed in either
direction, surrounding whitespace, multiple claims) plus negative cases
ensuring scheme + path mismatches still fail.
## Motivation
RFC 9728 §3.3 canonicalises the protected-resource identifier with a
trailing slash, but RFC 8707 resource indicators frequently omit it.
Upstream IdPs vary in which form they emit in the \`aud\` claim (Google
trims, Auth0 retains, some clients round-trip whatever the IdP sent).
Strict byte equality therefore fails routinely on legitimate setups.
Resource servers writing this comparison by hand all converge on the
same trim-trailing-slash + whitespace logic; exporting a canonical
helper saves every consumer from re-deriving it.
## Test plan
- [x] \`go test ./oauthex/... -run MatchesResource\` passes.
- [x] Positive cases: exact match, trailing slash on either side,
surrounding whitespace, multi-claim slice with one match.
- [x] Negative cases: empty slice, no match, path mismatch, scheme
mismatch (HTTPS vs HTTP must still fail).
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Guglielmo Colombo <guglielmoc@google.com>
6a6ade920b