Allow providing a custom discovery endpoint

Since the discovery endpoint is very important for security, we need to be sure we can reach it, even if it cannot be deduced from the provider's UR (for example, if the provider does not properly follow the specifications).