feat: Add Webauthn support

[RicardoE105]

Summary

This feature came out of Hackmation in the Berlin Mitte IRL. Some folks in the community and internally are interested in getting this feature production-ready. In an attempt to make it happen, and track progress, you can see below the to-do.

TO-DO

• Save security keys in the database, instead of in memory. See the suggested model here.
• When user is logged and security keys are enabled add user id to cookie, so we can return the challenge for the user's registered keys.
• Return security keys feature flag in /settings endpoint. Currently we only return whether MFA is enabled or not (referring to TOTP). We need to make more generic. e.g: { "mfa": { "securityKeys": { "enabled": true }, "totp": { "enabled": true } } }.
• Return whether the user has security keys or TOTP enabled in the GET /login endpoint. We will use this data to build the MFA section in the user's profile.
• Update MFA endpoints to differentiate between TOTP and security keys.
• Prompt for security keys when user's attempts to change password.
• Make all actions in MFA section for each MFA method to work. e.g disable or set as default.
• Add tests to new endpoints
• Add e2e tests to test security keys flow if possible.
• Nice to have - Allow for passkeys as well as it basically uses the same mechanism as security keys.
• Nice to have - Allow owner via settings to enforce members to enable a MFA method at any time. This could be an awesome feature for companies that need to meet security compliances.

To be determined:

1. Currently, the instance owner can disable or enable MFA (referring to TOTP) in the instance via env variables. Do we want to deprecate this behavior and always make it available in the instance? Whatever we decide here, we need to do the same with Security keys.
2. Should make the MFA logic generic so we could easily extend to other MFA methods like SMS, Push notifications or Code in email easily? is it worth it considering the before mentioned methods are less secure than TOTP and security keys.
3. Should we allow multiple MFA methods to be enabled at the same time? Github for example, allows you to do this, which is very convenient when your browser does not support Webauthn (very unlikely I think), but defeats the whole purpose of having security keys in the first place, as the attacker could use a less secure MFA method to gain access to your account.

Review / Merge checklist

• PR title and summary are descriptive. Remember, the title automatically goes into the changelog. Use (no-changelog) otherwise. (conventions)
• Docs updated or follow-up ticket created.
• Tests included.

  A bug is not considered fixed, unless a test is added to prevent it from happening again.
  A feature is not complete without tests.