Scoped Webauthn Challenges

[Joerger]

Implements scoped Webauthn challenges as described in #35185.

Follow up PRs:

• Add audit events and product metrics
• Prompt for reusable MFA when needed to avoid redundant mfa prompts (tctl users add, tctl create muliple-resources.yaml, etc.`)

changelog: Add scope to WebAuthn challenges

[github-actions]

The PR changelog entry failed validation: Changelog entry not found in the PR body. Please add a "no-changelog" label to the PR, or changelog lines starting with changelog: followed by the changelog entries for the PR.

[mdwn]

So, admittedly this review was a bit daunting to me. It looks pretty straightforward as a replacement of more "basic" MFA with scoped MFA. I can't speak to the validity of the scopes, but otherwise LGTM.

[mdwn]

nit: You could replace this if statement and the subsequent return with just

return trace.Wrap(a.authorizeAdminAction(ctx, authContext)

[codingllama]

Reviewed the first few commits, more to follow.

I would move proto definitions (and a possible "refactor" of SessionData) to a separate PR. Nailing definitions is a good part of the battle.

[codingllama]

A few more comments.

I can say with certainty now that this PR is too big. Please split into smaller, self-focused parts.

A few split ideas:

1. Proto definitions
2. (Possible) Make SessionData a storage-only type
3. Add scopes lib/auth/webauthn (minimal code changes elsewhere)
4. Add scopes to other important methods (server-side)
5. Add scopes to other important methods (client-side)
6. Teleport binary changes (if significant/not part of the above)
7. Web UI changes