Allow configuring WebAuthn userVerification (currently hardcoded to "discouraged")

Currently, userVerification in the WebAuthn challenge response is hardcoded to "discouraged". This means biometric FIDO2 keys (e.g. fingerprint sensors) never actually verify the biometric — the sensor just acts as a touch button, and any finger works.

It would be great to have an option (env var or admin panel setting) to set userVerification to "preferred" or "required", so biometric security keys can actually enforce fingerprint matching as part of the WebAuthn 2FA flow.

Use case: using a FIDO2 security key with a fingerprint sensor as a 2FA method, expecting the fingerprint to be verified — but currently any touch on the sensor is accepted regardless of whose finger it is.