feat(verifier): profile-free response verification helpers

[Spomky]

Summary

Companion of #876 (WebauthnOptionsResponse) for the response side. Adds a single autowired entry point (WebauthnResponseVerifier) so applications can write their own response controllers without touching creation_profiles / request_profiles config or the bundle's profile-driven AttestationResponseController / AssertionResponseController.

$result = $this->verifier
    ->forAttestation('example.com')
    ->verify($request);
// $result->credentialRecord is already persisted
// $result->publicKeyCredential is the deserialised body (useful for Signal API)
// $result->userEntity is the user loaded from OptionsStorage

$result = $this->verifier
    ->forAssertion('example.com')
    ->verify($request);
// $result->credentialRecord has its counter / backup state updated

Design

• Two typed verifiers: WebauthnAttestationVerifier and WebauthnAssertionVerifier (returned by the entry-point factories) so IDE autocomplete only proposes the methods relevant to each ceremony.
• Auto-persist on attestation: the new credential record is saved through CanSaveCredentialRecord by default. Opt out with withSaveCredential(false) if your controller wants to own persistence (transactions, extra fields, etc.).
• Auto conditional mediation: when stored creation options carry mediation: conditional, the verifier transparently switches to the conditional creation ceremony manager (relaxes UV per the W3C spec). One call site, both flows.
• Failure split:
  • BadRequestHttpException for malformed inputs (wrong content type, empty body, deserialisation failure, unknown challenge, response/options type mismatch, RP ID mismatch). Symfony's HTTP layer turns these into HTTP 400 automatically.
  • WebauthnAuthenticationFailureException for ceremony validation failures, carrying the deserialised PublicKeyCredential, the underlying AuthenticatorResponse, the PublicKeyCredentialOptions and the user entity. Lets controllers build Signal API payloads (signalUnknownCredential, etc.) from a single exception.

What's new

• Webauthn\Bundle\Service\AbstractWebauthnVerifier (template method: deserialise body, load stored options, delegate validation)
• Webauthn\Bundle\Service\WebauthnAttestationVerifier
• Webauthn\Bundle\Service\WebauthnAssertionVerifier
• Webauthn\Bundle\Service\WebauthnResponseVerifier (autowired entry point)
• Webauthn\Bundle\Service\WebauthnVerificationResult (typed return value)
• 16 unit tests + reusable SaveableInMemoryCredentialRepository fixture

Drive-by

• Drop a stale @phpstan-ignore-next-line in WebauthnSignalResponse that no longer matched on PHP 8.4.
• Regenerate the PHPStan baseline against PHP 8.4 (the version CI runs).

Notes

The existing profile-driven controllers stay untouched and supported until 6.0; this is a strictly additive, opt-in API. Documentation PR is web-auth/doc#TBD (will link once opened).