feat(transport): advertise NFC and hybrid transports

[AlfioEmanueleFresta]

The library implements four transports but advertised only USB and BLE, and registration responses always returned an empty transports list. This adds NFC and hybrid to the public transport list, with NFC shown only when a backend is compiled in, and fills the registration transports from the transport actually used, ordered and deduplicated per the WebAuthn rules.

Closes #258.

[iinuwa]

@AlfioEmanueleFresta, my read of the WebAuthn spec says that transports should be all the transports supported by the authenticator. Since libwebauthn doesn't expose authenticator get info directly, does it make sense to have the transports be returned by libwebauthn (e.g. in the MakeCredentialResponse) instead of the caller specifying it?

[AlfioEmanueleFresta]

Thanks @iinuwa, agreed. I switched it to do exactly that. The registration transports now come from the authenticator's getInfo (member 0x09, which libwebauthn already decodes), populated on MakeCredentialResponse rather than specified by the caller, and folded together with the transport the ceremony actually ran over. The list is emitted as unique tokens in lexicographical order per WebAuthn L3 §5.2.1.1.

This follows the spec's getTransports() definition (the transport used to register, unioned with the transports the client believes the authenticator supports) and matches Chromium, which folds getInfo 0x09 into that set. For authenticators that don't report 0x09 (CTAP 2.0) or on the U2F downgrade path, the union reduces to just the ceremony transport, which preserves the prior behavior.

[iinuwa]

Yeah, that sounds good to union those, though it would be weird if an authenticator didn't specify that it supports the transport it just used.

[iinuwa]

LGTM!