Clarify the valid values for user handle in the Authentication Assertion

[lykahb]

The 5.4.3. User Account Parameters for Credential Generation requires that the user handle must not be an empty string.
However, the 5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse) does not explicitly say if userHandle may be an empty string. I would infer that it must be either null, or the same value as passed under PublicKeyCredentialUserEntity when registering.

At the moment not all browsers have consistent behavior. For my authenticator (YubiKey) Firefox and Chromium always return userHandle: null. However, Safari returns userHandle: "". I opened a bug report for Safari based on my understanding of the authentication part of the WebAuthn spec.

[lykahb]

Duplicating #1722