Add passkeys project: WebAuthn ceremonies, a software authenticator and the one-time-token fallback

Fourth Maven project in the repository. Registration and authentication run end to
end with no browser and no hardware key: VirtualAuthenticator emits real CBOR
attestation objects and real ES256 assertion signatures, and tools/PasskeyCeremony.java
drives the live HTTP endpoints with them.

Profiles cover userVerification REQUIRED, DIRECT attestation, a disallowed origin and
JDBC persistence. Eleven doc chapters and twelve captured transcripts under docs/passkeys
and docs/output/pk-*.txt, all regenerated by passkeys/scripts/run-all.sh.

passkeys/scripts/run-all.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# Regenerates every docs/output/pk-*.txt file in this repository.
+#
+# Timings and instants differ between runs; nothing else should.
+source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+cd "$MODULE_DIR"
+mvn -B -q compile
+for script in ceremony counter user-verification origin attestation duplicate bootstrap step-up ott-fallback jdbc filters test-run; do
+  echo ">>> scripts/$script.sh"
+  "./scripts/$script.sh" > /dev/null
+done
+stop_app
+ls -la "$OUTPUT_DIR"/pk-*.txt