fix(coreapi): assert token_exchange_url path in validateExchangeURL

exchangeSubjectToken strips oauthTokenPath and PostOAuthToken re-appends it, but validateExchangeURL only gated scheme and host. A hint whose path wasn't /oauth/token would make the strip a no-op and POST to a server-chosen path. Validate the path so the round-trip is honest.