Add passkeys project: WebAuthn ceremonies, a software authenticator and the one-time-token fallback

Fourth Maven project in the repository. Registration and authentication run end to
end with no browser and no hardware key: VirtualAuthenticator emits real CBOR
attestation objects and real ES256 assertion signatures, and tools/PasskeyCeremony.java
drives the live HTTP endpoints with them.

Profiles cover userVerification REQUIRED, DIRECT attestation, a disallowed origin and
JDBC persistence. Eleven doc chapters and twelve captured transcripts under docs/passkeys
and docs/output/pk-*.txt, all regenerated by passkeys/scripts/run-all.sh.

passkeys/scripts/run.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+# Start the demo with the given profiles.
+#
+#   ./scripts/run.sh                    defaults: rpId localhost, UV preferred, in memory
+#   ./scripts/run.sh uvrequired         user verification REQUIRED on both ceremonies
+#   ./scripts/run.sh attestationdirect  ask for DIRECT attestation and watch nothing change
+#   ./scripts/run.sh badorigin          relying party expects an origin the client won't send
+#   ./scripts/run.sh jdbc               credentials in H2 using Spring Security's own DDL
+#   ./scripts/run.sh trace              every WebAuthn log line the framework emits
+source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+start_app "${1:-}"
+echo "log: $APP_LOG"
+echo "browser: $BASE_URL/login   (user/password, then $BASE_URL/webauthn/register)"