Fix WebAuthn/Duo credentials merge bug (OKTA-1209004)

[AlexNachbaur]

Summary

• Adds a regression test (testNestedWithMultipleChildValues) proving Remediation.Form.Field.formValue drops sibling fields when a named field's nested form has 2+ children — e.g. WebAuthn's credentials object (authenticatorData/clientData/signatureData), which is the root cause of OKTA-1209004.
• Cherry-picks the fix from fixes some idx calls where the not all post body values are sent #282 (commit 634cea8): accumulate nested child values into a separate nestedJSON object via += merge, then assign once, instead of overwriting json[name] on every loop iteration.

Root cause

In IDXRemediation+Extensions.swift, the "named field with nested form" branch looped over each child field and did json[name] = nestedResult every iteration — each nested child's own {childName: value} wrapper replaced the previous one, so only the last-processed child survived. When the last child happened to be unset (e.g. optional userHandle on the autofill UI challenge), the result was an empty credentials: {}, matching the customer's HAR capture on Crate & Barrel's org.

This affects:

• WebAuthnAuthenticationCapability (passkey/WebAuthn auth) — confirmed via mock fixture (3 fields)
• WebAuthnRegistrationCapability (passkey/WebAuthn registration) — confirmed via mock fixture (2 fields)
• DuoCapability — only sets a single field today, so not currently exercised by this bug, but not covered by a fixture-based test either