finish removing "create credential" permissions policy cruft

[equalsJeffH]

Upon taking a close look at the spec with regards to references to "permissions policy", I've noticed that there remains some cruft with respect to there being a permissions policy with respect to credential creation (i.e., publickey-credential-create), which we ostensibly removed via PR #1394.

specifically:

1. Section [5.1.3. Create a New Credential - PublicKeyCredential’s [Create] Method](https://www.w3.org/TR/webauthn-3/#sctn-createCredential) continues to have a Note regarding permissions policy (it should not):

   Note: Invocation of this internal method indicates that it was allowed by permissions policy, which is evaluated at the [CREDENTIAL-MANAGEMENT-1] level. See § 5.9 Permissions Policy integration.

2. The Note in section 5.9. Permissions Policy integration continues to mention [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) --- it should not.