TDF KAS field can have different paths and scheme for a single KAS

[pflynn-virtru]

Currently, we support gRPC and RESTful endpoints for rewrap. If a TDF is created with one SDK that uses a gRPC endpoint, the KAS field in TDF is gRPC, then if an SDK that uses RESTful it will fail decrypt.

In nanotdf, the KAS field is endpoint specific https://github.com/opentdf/spec/tree/main/schema/nanotdf#331-header

In TDF3, the url field in Key Access Object, https://github.com/opentdf/spec/blob/main/schema/tdf/KeyAccessObject.md#keyaccess

One solution, the .well-known have the supported KAS endpoints and the TDF KAS field only specifies the path where .well-known can be found.

For flexibility, possible KAS endpoints in the .well-known should support different schemes: https://, wss://. and different paths

[strantalis]

@pflynn-virtru To start could this be as simple as the sdk being smart to add the rewrap path if they don't see it and strip it off if they do see it in the field?