Reference UserWebauthnMethods into UserMultifactorMethods [3/4]

[jenshenny]

What problem are you solving?

This PR is based off of a larger PR #3805

As part of #3800, there are methods in UserMultifactorMethods that are specific to Webauthn.

What approach did you choose and why?

This PR moves verify_webauthn_otp method to UserWebauthnMethods. I also moved the inclusion of UserWebauthnMethods into UserMultifactorMethods as methods in UserMultifactorMethods relies on the methods in UserWebauthnMethods.

[codecov]

Codecov Report

Merging #3808 (4bfbf57) into master (d872189) will increase coverage by 0.00%.
The diff coverage is 100.00%.

@@           Coverage Diff           @@
##           master    #3808   +/-   ##
=======================================
  Coverage   98.81%   98.81%           
=======================================
  Files         214      214           
  Lines        5243     5244    +1     
=======================================
+ Hits         5181     5182    +1     
  Misses         62       62           

Impacted Files	Coverage Δ
app/models/user.rb	100.00% <ø> (ø)
app/models/concerns/user_multifactor_methods.rb	100.00% <100.00%> (ø)
app/models/concerns/user_webauthn_methods.rb	100.00% <100.00%> (ø)

[ericherscovich]

Somewhat related to my comment in #3806 but is there any benefits in moving this from User into UserMultifactorMethods? My thought is it may be better to keep it at the higher level, in the User, so these can be included individually if needed, instead of including all multifactor methods to get just the OTP ones, as an example.

[jenshenny]

My thought is it may be better to keep it at the higher level, in the User, so these can be included individually if needed, instead of including all multifactor methods to get just the OTP ones, as an example.

That's a good point. However if you just include UserMultifactorMethods, there are some methods from UserOtpMethods and UserWebauthnMethods that are required for UserMultifactorMethods to work. This includes references to verify_webauthn_otp and verify_digit_otp. I think it would be nice for the user to include UserMultifactorMethods and not worry about needing to include all the other concerns. wdyt?

[bettymakes]

Nice clean up 🧹 💯 . LGTM 👍 .