[w-goog]

This PR is the first half of fixing #380.

• The nullable URL getters on OIDServiceDiscovery now check for a string before parsing, so a sloppy optional URL (unparseable, null, not a string) just reads as nil.
• Validation only covers the nonnull ones (issuer, authorization_endpoint, token_endpoint, jwks_uri). They have to be present and parse, and a JSON null fails with OIDErrorCodeInvalidDiscoveryDocument instead of raising an exception. An authorization_endpoint that doesn't parse now fails the document too, like the other required URL fields.
• Yay for re-enabling the two pendingTest... cases!! plus three for the sloppy-optional cases.

RFC 8414 documents that omit jwks_uri & co. still fail validation. The right fix is to mark those properties nullable, but that'd be source-breaking, so we'll do that in the 4.0 release.

Note for reviewers: I narrowed the URL check, since a provider's sloppy op_tos_uri shouldn't block a sign-in. Only the nonnull URL fields are validated. The nullable getters already returned nil for a bad URL, and now do the same for null or a non-string.