The discovery endpoint is an unique (realm-wide) path that provides information for clients - endpoint locations, keys, supported algorithms, etc.. It shouldn't contain anything secret, so authentication is usually not required. Note that the endpoint would also need to be protected via means other than what is configured for client authentication (JWT, certificate, secret) since public clients don't use authentication, but still expect to be able to access the discovery endpoint.

If it's imperative, you could add authentication via a reverse proxy, but adding it may break clients that expect discovery to be open - I don't remember seeing parameters for the discovery endpoint for any clients - though you can configure the clients manually in most cases.