Change WebAuthn config

1. The user verification for the registration is now configured with USER_VERIFICATION_REQUIREMENT_DISCOURAGED
   which should result in no need for PIN, same goes for authn
   verifications.
2. The attestation conveyance is reset to NONE, it was previously
   enabled to allow for vendor certificate based attestation.

config/packages/webauthn.yaml

@@ -16,14 +16,14 @@ webauthn:
             authenticator_selection_criteria:
                 authenticator_attachment: !php/const Webauthn\AuthenticatorSelectionCriteria::AUTHENTICATOR_ATTACHMENT_NO_PREFERENCE
                 require_resident_key: false
-                user_verification: !php/const Webauthn\AuthenticatorSelectionCriteria::USER_VERIFICATION_REQUIREMENT_PREFERRED
-            #  this is needed for SURFsecureID as we want to whitelist authenticators by vendor/certification (default is none)
-            attestation_conveyance: !php/const Webauthn\PublicKeyCredentialCreationOptions::ATTESTATION_CONVEYANCE_PREFERENCE_DIRECT
+                user_verification: !php/const Webauthn\AuthenticatorSelectionCriteria::USER_VERIFICATION_REQUIREMENT_DISCOURAGED
+            #  this is no longer needed for SURFsecureID as we want to whitelist authenticators by vendor/certification (default is none)
+            attestation_conveyance: !php/const Webauthn\PublicKeyCredentialCreationOptions::ATTESTATION_CONVEYANCE_PREFERENCE_NONE
     request_profiles:
         default:
             challenge_length: 64
             timeout: 30000
-            user_verification: !php/const Webauthn\AuthenticatorSelectionCriteria::USER_VERIFICATION_REQUIREMENT_PREFERRED
+            user_verification: !php/const Webauthn\AuthenticatorSelectionCriteria::USER_VERIFICATION_REQUIREMENT_DISCOURAGED
 
     metadata:
         enabled: true