feat: Retry WebAuthn operations when PUAT is required

[DennisDyallo]

Summary

• Retry WebAuthn MakeCredential/GetAssertion once when CTAP returns PuatRequired and UV was not already required.
• Remint MakeCredential tokens after exclude-list preflight and preserve silent up=false probing.
• Consolidate retry helpers and shared test helpers.

Verification

• dotnet toolchain.cs -- test --project WebAuthn
• dotnet toolchain.cs -- test --integration --project WebAuthn --smoke --filter "Category!=RequiresUserPresence"
• Read-only review: no findings

[Copilot]

Pull request overview

This PR updates the WebAuthn client flow to handle CTAP PuatRequired responses by retrying MakeCredential/GetAssertion once with UV forced to Required, and refactors shared helper logic (token acquisition, retry/error mapping, and memory zeroing). It also consolidates and extends unit-test support to cover the new retry paths and exclude-list preflight behavior.

Changes:

• Add “retry once with UV required” behavior for MakeCredential/GetAssertion when CTAP returns PuatRequired and UV was not already required.
• Refactor WebAuthnClient internals (token acquisition helper, retry helpers, and pinUvAuthParam zeroing wrappers).
• Add/adjust unit tests and shared test helpers for PUAT retry and exclude-list preflight/remint behavior.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/WebAuthn/src/Client/WebAuthnClient.cs	Implements PUAT retry behavior, refactors token acquisition and adds request wrappers that zero pinUvAuthParam.
src/WebAuthn/src/Internal/ExcludeListPreflight.cs	Zeros the computed pinUvAuthParam after exclude-list probing.
src/WebAuthn/src/Client/FidoSessionWebAuthnBackend.cs	Ensures up option is mapped into FIDO2 options and zeroes copied pinUvAuthParam after session calls.
src/WebAuthn/tests/Yubico.YubiKit.WebAuthn.UnitTests/TestSupport/TestPinUvAuthProtocol.cs	Adds reusable test protocol implementation for Span-based protocol calls.
src/WebAuthn/tests/Yubico.YubiKit.WebAuthn.UnitTests/Internal/ExcludeListPreflightTests.cs	Switches to shared TestSupport protocol helper.
src/WebAuthn/tests/Yubico.YubiKit.WebAuthn.UnitTests/Client/WebAuthnClientMakeCredentialTests.cs	Adds unit tests validating MakeCredential PUAT retry and exclude-list remint permission behavior.
src/WebAuthn/tests/Yubico.YubiKit.WebAuthn.UnitTests/Client/WebAuthnClientGetAssertionTests.cs	Adds unit tests validating GetAssertion PUAT retry and “retry then no-credentials” behavior.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.