fix(auth): set WebAuthn user verification per request (#38805)

Registration omitted `userVerification`, so Chromium raised the
credential to credProtect level 3 and the authenticator then hid it from
the second-factor login, which asked for `discouraged`. Registration and
each login now set their own value, with `preferred` on the second
factor so credentials already registered at level 3 keep working without
re-enrollment.

Also add relevant e2e test coverage for webauthn, one test chromium only
because Firefox lacks the APIs needed.

Fixes https://github.com/go-gitea/gitea/issues/33531
Fixes https://github.com/go-gitea/gitea/issues/36019
Fixes https://github.com/go-gitea/gitea/issues/38139

modules/auth/webauthn/webauthn.go

@@ -28,13 +28,10 @@ func Init() {
 
 	WebAuthn = &webauthn.WebAuthn{
 		Config: &webauthn.Config{
-			RPDisplayName: setting.AppName,
-			RPID:          setting.Domain,
-			RPOrigins:     []string{appURL},
-			AuthenticatorSelection: protocol.AuthenticatorSelection{
-				UserVerification: protocol.VerificationDiscouraged,
-			},
-			AttestationPreference: protocol.PreferDirectAttestation,
+			RPDisplayName:         setting.AppName,
+			RPID:                  setting.Domain,
+			RPOrigins:             []string{appURL},
+			AttestationPreference: protocol.PreferNoAttestation, // Gitea never verifies attestation
 		},
 	}
 }