feat(ssh): add CTAP 2.1 UV tokens to the FIDO client #339

Two client-side FIDO parity gaps were identified after #333 and #334. The CTAP 2.1 UV-token work is complete here. WebAuthn host-key support remains blocked on released upstream ssh-key and russh support and is now tracked separately in #345.

1. UV tokens for built-in-sensor authenticators

Without a PIN, sign (src/ssh/security_key/internal/mod.rs:219-227) sends options.uv = true, and Device::pin_token (device.rs:208-242) only issues clientPIN 0x05/0x09. libfido2 does something else when the device reports pinUvAuthToken (assert.c:131-139, pin.c:233-238): it fetches a token with getPinUvAuthTokenUsingUvWithPermissions (0x06, no pinHashEnc), sends pinUvAuthParam, and leaves uv out. Without uv it returns FIDO_ERR_PIN_REQUIRED. sk-usbhid.c:723-736 turns PIN_REQUIRED, PIN_INVALID and OPERATION_DENIED into SSH_SK_ERR_PIN_REQUIRED, which brings up the PIN prompt. CTAP 2.0 devices keep the options.uv path.

• A CTAP 2.1 mock with uv and pinUvAuthToken signs a verify-required key with no PIN. The mock records ClientPin 0x06 with permission 0x02 and the rpId, and a GetAssertion with uv: None and pin_auth set. The mock handler (mock_handlers.rs:178) also accepts 0x06.
• If the mock answers 0x06 with 0x36, sign returns PinRequired, and retrying with the PIN goes through 0x09.
• The CTAP 2.0 uv path is unchanged. The "unsupported" notes in docs/openssh-compatibility-status.md are removed.

2. webauthn-sk-ecdsa-sha2-nistp256@openssh.com (moved to #345)

bssh leaves this name out (src/app/query.rs:48-53, src/ssh/tokio_client/algorithms.rs:223-227). It is the only remaining difference from the reference -Q/-G output. russh checks host-key signatures through ssh-key (russh-0.64.1/src/client/kex.rs:337), and the newest published ssh-key, =0.7.0-rc.11 (Cargo.toml:100), has no WebAuthn support. bssh cannot add it without a fork, so this item waits on a released ssh-key and russh in #345.

• WebAuthn-sk host keys and host certificates verify. Tracked in feat(ssh): add webauthn-sk host-key support #345.
• The names sit where OpenSSH 10.3p1 puts them, and the exceptions are dropped from the tests at query.rs:165,212 and algorithms.rs:621, from docs/man/bssh.1:125, and from the status doc. Tracked in feat(ssh): add webauthn-sk host-key support #345.

Verification

cargo fmt --check && cargo clippy -- -D warnings && cargo test --lib security_key && cargo test --lib query && cargo test --lib algorithms