Key active credential types by top-level browsing context

[npm1]

They are currently keyed by environment settings object, which means an iframe and its parent would both be allowed to request a credential at the same time. This is not really allowed at least in Chrome impl. @nsatragno asks if it is ok for a frame to know that some other frame in the tree has requested a credential. I think this is not ideal but also not a huge deal so we can for now fix the keying and worry about this later.