fix: source WebAuthn RP config from env vars

[fadymak]

Requires relying party configuration to be set in environment variables.

• MFA WebAuthn challenge and verify no longer accept rpId / rpOrigins from the request body.
• Validates GOTRUE_WEBAUTHN_RP_* at startup whenever MFA WebAuthn enroll or verify environment vars are enabled.

rpId and rpOrigins under the webauthn object on POST /factors/{factor_id}/challenge and POST /factors/{factor_id}/verify are now silently ignored — they must no longer be sent in the request bodies.

GOTRUE_WEBAUTHN_RP_ID, GOTRUE_WEBAUTHN_RP_ORIGINS, and GOTRUE_WEBAUTHN_RP_DISPLAY_NAME must be set if MFA WebAuthn enroll or verify are enabled.

[cstockton]

👍