Provide a Passkey (WebAuthn) Authentication plug-in for Login Flow

Problem/Motivation

Login Flow currently ships different plug-ins, but offers no passkey (WebAuthn) option, while passkeys are becoming the standard passwordless login method. Existing passkey modules (e.g., webauthn, decoupled_passkeys) implement their own standalone login forms and do not integrate with Login Flow's multi-method flow. In Login Flow, several authentication methods can coexist per account (password / email link / passkey, etc.), and the first applicable plug-in wins. This integration is currently missing.

Steps to reproduce

Proposed resolution

Provide a new login_flow_webauthn sub-module implementing a Login Flow Authentication plug-in for passkeys (fingerprint, Face ID, Windows Hello, security keys), built on web-auth/webauthn-lib ^5.3.

Design goals:

• Zero changes to the base login_flow module: Everything (plug-in, JSON ceremony endpoints, JS, management forms, backoffice) lives in the sub-module and uses only public extension points (Authentication plug-in API, form_user_login_form_alter — verified to run after the base and email-link alters).
• Coexistence of methods: The plug-in captures only accounts owning a registered credential (roles/domains configurable); otherwise, the flow falls through to the next method.
• Guided UX: A post-login enrollment modal (once per session, dismissible, link reachable because the user is authenticated).
• Administration: Per-user self-service page (/user/{user}/passkeys, /webauthn/enroll), plus an admin overview at /admin/people/passkeys (account, label, credential, counter, created/last-used dates, filter, single + bulk delete), and a configurable per-user cap (max_per_user, default 5).
• Security: One-shot 10-minute challenges in private tempstore, exact origin (scheme+host) check, etc.
• i18n: All code in English via t() / $this->t() / Drupal.t(). French .po shipped (translations/fr.po, msgfmt-validated).

Remaining tasks

Prepare an MR

User interface changes

• Adds a passkey login button to the Login Flow user login form.
• Adds a post-login enrollment modal.
• Adds new admin overview page at /admin/people/passkeys.
• Adds new user self-service tab at /user/{user}/passkeys.

API changes

No changes to the base login_flow module API. This proposal strictly relies on existing public hooks and APIs.

Data model changes

New database table(s) to store WebAuthn credentials (credential ID, public key, counter, label, uid, dates).