Implement FIDO2 login and registration

[codingllama]

Implements CLI login and registration using go-libfido2. Covers both MFA and passwordless use cases.

The FIDO2 implementation is akin to the existing U2F Login / Registration logic, including a similar "device detection" loop. A few notable differences are:

• A filtered "device search" step that ends as soon a suitable device is found
• A more explicit "device selection" step, which makes it easier to implement PIN flows

The MFA UX for end-users should remain mostly unaltered.

There are no separate methods for MFA and passwordless, as much of the logic would be the same. Instead, the methods react to the assertion/credential parameters accordingly.

At this moment this code is isolated from other callers, as well as from our build processes via the libfido2 tag. This is to avoid impact to other developers, as go-libfido2 has a few requirements before it can be downloaded or executed.

#9160

[codingllama]

Note to reviewers: a reasonable chunk of the PR are test tables, the production code added is not that big. I've written it so it may be reviewed commit-by-commit, which should make it easier to absorb, but let me know if you'd rather have me split registration to a separate PR.

I also have a test program that runs the code against real authenticators, which I didn't include here, but give me a shout if you'd like to try it out.

[codingllama]

PTAL?

[codingllama]

Friendly ping @zmb3 @rosstimothy @Tener ?

[rosstimothy]

Sorry @codingllama I was half way through looking at this earlier when GitHub started having issues

[codingllama]

Thanks for the review, @rosstimothy. PTAL?

[codingllama]

Thanks for the approval, folks.