Compare issuer and strings exactly

A mismatch means the response data MUST NOT be used.

• The returned issuer MUST be identical to the issuer identifier used to derive the retrieval URL. If not identical, the response data MUST NOT be used (§3.3). A host that resolves to the same address, a valid certificate or a similar-looking path does not replace this equality check.
• §4 requires JSON escaping to be removed before comparing Unicode code points. It explicitly says Unicode Normalization MUST NOT be applied and requires code-point-to-code-point equality. These rules cover JSON member names and other strings as well as issuer values.
• For example, a JSON escape for the t in /team decodes to the same string as a literal t. A differently cased hostname, an extra terminal slash, an explicit default port or a percent-encoded path spelling remains a different string in this check. Do not first serialize through a URL canonicalizer.
• The final state compares general metadata strings with precomposed é versus e followed by a combining acute accent. They may look similar, but their code-point sequences differ. It is a string-comparison example, not a claim that either string is a valid issuer URL.
• Passing this equality comparison is necessary, not sufficient for trustworthy metadata: the client must also check TLS and any applicable signed metadata, and still needs a legitimate choice of issuer and protected resource (§§1,2.1,6).