Add passkeys project: WebAuthn ceremonies, a software authenticator and the one-time-token fallback

Fourth Maven project in the repository. Registration and authentication run end to
end with no browser and no hardware key: VirtualAuthenticator emits real CBOR
attestation objects and real ES256 assertion signatures, and tools/PasskeyCeremony.java
drives the live HTTP endpoints with them.

Profiles cover userVerification REQUIRED, DIRECT attestation, a disallowed origin and
JDBC persistence. Eleven doc chapters and twelve captured transcripts under docs/passkeys
and docs/output/pk-*.txt, all regenerated by passkeys/scripts/run-all.sh.

passkeys/scripts/origin.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# What a phishing attempt looks like from the relying party's side, in both ceremonies.
+source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+start_app "" > /dev/null
+{
+  header "Registration from a disallowed origin"
+  ceremony wrong-origin
+  echo
+  echo "--- what the server logged ---"
+  grep -A4 -m1 -E 'BadOriginException|InconsistentClientDataTypeException' "$APP_LOG" || tail -5 "$APP_LOG"
+
+  header "Assertion from a disallowed origin"
+  ceremony wrong-origin-login
+} 2>&1 | tee "$OUTPUT_DIR/pk-origin.txt"
+stop_app