Standardize form validation for WebauthnSetupForm

[aduth]

🛠 Summary of changes

Refactors WebauthnSetupForm to validate parameters in a standardized manner:

• submit accepts a single hash of parameters
• Use ActiveModel::Model validation methods (validates, etc.) to add errors
• Success is based on ActiveModel::Model#valid? alone

This originally started with a desire to replace the ad hoc webauthn_setup_submitted with multi_factor_auth_setup, which then led to the realization that setups can happen through multiple pathways and forms (WebauthnSetupForm and WebauthnVisitForm). The changes here are intended to standardize behaviors in WebauthnSetupForm to help prepare for the next step of merging WebauthnSetupForm and WebauthnVisitForm.

📜 Testing Plan

Verify there are no regressions in the setup of a Face or Touch Unlock or Security Key MFA method.

Verify that tests pass:

rspec spec/forms/webauthn_setup_form_spec.rb