ProjectPasskeys: Replace requestedParties with rpId, and origins

[maduvena]

RP.ID is set one time, and can not be changed. It must be carefully considered, and is integral part of the access control for the authenticat

For jans, this is how we should be doing it:

RP.ID must always be set
RP.ID must be set separately from ORIGINS
RP.ID must be just the HOST part, or FQDN
RP.ID need to have a clear documentation
Origins are a list of origins (protocol + host + port), that must specified by the user separately

TODOs:

1. Replace requestedParties with rpId, and origin
2. Check ClientDataJson (contain origin)
   if origin returned in ClientDataJson is in the list of allowed origins, then pass
   Your origins can be, https://bank.com/ https://auth.bank.com/ https://internal.bank.com/

Origins can be a set, and can change

[shekhar16]

code has been committed as part of #9111.
Closing this ticket.

[maduvena]

TODOs:

• Write a test case
• Check a complete flow, Shekhar has done only the backend handling

References : 1. https://passkeys.dev/docs/advanced/related-origins/
2. Notes from Mike - https://developer.chrome.com/blog/passkeys-updates-chrome-129?hl=en

[maduvena]

New notes:

RP ID is a domain string only, and does not mention a scheme or port number as an origin does. The RP ID of a PublicKeyCredential sets it scope, i.e. it determines the origins on which it may be exercised as follows:

The RP ID must be equal to the origin's effective domain, or a registrable suffix of the origin's effective domain.

The origin's scheme must be 'https'.

The origin's port number is unrestricted.

This is done in order ...