LG-11429: Require user verifying device for F/T MFA setup

[jc-gsa]

🎫 Ticket

LG-11429

🛠 Summary of changes

Removes userVerification property, please see the ticket for technical information.

📜 Testing Plan

• Review registering, adding, and removing WebAuthn to an account on Windows devices
• Review registration and authentication for WebAuthn Platform on Android devices

[aduth]

For more details on closure, see related Slack discussion: https://gsa-tts.slack.com/archives/C05MGJ72GU9/p1701870871587539

Summary: Testing and external resources seem to indicate the discouraged is the expected behavior at this point in the user flow, i.e. adding an MFA method. The potential to allow an ineligible device to be enrolled is mitigated by #9609.

See also:

• https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/User_Presence_vs_User_Verification.html
• https://web.archive.org/web/20220129134233/https://chromium.googlesource.com/chromium/src/+/master/content/browser/webauth/uv_preferred.md
• https://help.okta.com/oie/en-us/content/topics/identity-engine/authenticators/configure-webauthn.htm
• Avoid user verification duo-labs/webauthn.io#13
• Explicitly set userVerification to discoraged when getting the options for create/get mastodon/mastodon#16545