libfido2: add macOS support

[artemist]

Motivation for this change

Currently, libfido2 does not support building on macOS. This means that OpenSSH 8.2 will be unable to support ecdsa-sk keys on macOS when running as an SSH client.

Things done

• pass IOKit to libfido2
• Add a patch so that cmake uses lld flags when linking
• Upgrade from 1.3.0 to 1.3.1 (based off libfido2: 1.3.0 -> 1.3.1 #80781)
• Specify CMAKE_INSTALL_LIBDIR so that the demo binaries link
  correctly on macOS and libfido2.pc specifies correct arguments

I tested that FIDO keys were detected on both nixOS and macOS 10.13 (the newest mac I own).
I also built openssh 8.2p1 using the changes from #80196 with libfido2 and was able to generate an ecdsa-sk keypair on both nixOS and macOS.

Note that I do not have permission to build with ofborg on macOS, so someone else will have to do that for me.

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

[prusnak]

@GrahamcOfBorg build libfido2

[prusnak]

The fix looks great! Will you upstream the patch to https://github.com/Yubico/libfido2 please?

[artemist]

I'll want to find something more robust by testing supported compile flags before I upstream it. I'm currently just using "on a mac and using Clang" as a proxy for lld, which is not entirely accurate (except in the bounds of nixOS).

[prusnak]

FTR the issue was just fixed in the upstream where it was reported by mmahut: Yubico/libfido2#127

[artemist]

Oh, thanks! I don't think it's worth it to make a new PR to switch to their official patch, but we can remove the patch when the next one releases.

[prusnak]

Agreed