feat: add WebAuthn PRF extension support

[billiegoose]

Hi, huge Keyguard fan here. I hope this contribution finds you well. I wanted to use passkeys to derive an AES key in my website. I learned that the feature is supported in Google Password and Apple's Password manager but not (yet) for Keyguard. Normally I wouldn't allow Claude to make a PR for me, but because WebAuthn is a well-defined specification, I am more confident that it is probably implemented correctly. I did manually test it as well, using a debug build APK and Android/Firefox/Keyguard and it worked.

---

The PRF extension lets relying parties derive deterministic symmetric keys from a passkey — enabling phishing-resistant end-to-end encryption. See Corbado's writeup for use cases.

Changes (all in :common):

• Registration: return clientExtensionResults.prf.enabled = true when extensions.prf is requested
• Authentication: compute and return clientExtensionResults.prf.results from extensions.prf.eval / evalByCredential
• CTAP 2.2+: return PRF results immediately at creation time when extensions.prf.eval is included
• Unit tests for the PRF computation

Manually Tested against https://webauthn-passkeys-prf-demo.explore.corbado.com/ on Mobile Firefox 151 / Android 16:

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[billiegoose]

I have read the CLA Document and I hereby sign the CLA

[billiegoose]

recheck

[AChep]

Thanks! It looks very reviewable to me and on the first glance it all makes sense. I'll do a proper review later on and hopefully will merge that in!

[AChep]

internal fun computeWebAuthnPrf(
    cryptoService: CryptoGenerator,
    privateKeyBytes: ByteArray,
    prfInput: ByteArray,
): ByteArray {
    val prfSalt = cryptoService.hashSha256(PasskeyUtils.PRF_LABEL + prfInput)
    val hmacKey = cryptoService.hmacSha256(
        key = privateKeyBytes,
        data = "prf".toByteArray(Charsets.UTF_8),
    )
    return cryptoService.hmacSha256(
        key = hmacKey,
        data = prfSalt,
    )
}

The hmacKey computation doesn't really follow the spec. In the spec we should create and store a separate key specifically for the extension. While the current approach seems secure it will very likely break the compatibility with future Bitwarden clients.

This implementation is basically https://community.bitwarden.com/t/support-for-storing-prf-capable-passkeys-in-bitwarden-vault/82239/61 of the alternative Keyguard world.

[AChep]

We can't create a new property either, because we will not be able to sync it back to Bitwarden servers. This is a stalemate until Bitwarden decides to implement it themselves.

[billiegoose]

Ah... I see. Oh well!