RS1 is RSASSA-PKCS1-v1_5 with SHA-1, which is no longer acceptable for digital
signatures. web-auth/cose-lib emits an E_USER_WARNING when the algorithm is
built without an explicit acknowledgement, and the Symfony error handler turns
that warning into an exception in the dev environment, so every attestation or
assertion request answered with a 500 as soon as the algorithm manager was
built.
Acknowledging the algorithm in the service definition would have silenced the
warning while keeping an insecure algorithm in the default verification
manager. The bundle should not make that choice on behalf of the applications,
so the definition is removed instead.
BREAKING CHANGE: webauthn.cose.algorithm.RS1 is no longer registered, so the
default verification manager no longer accepts RS1 signatures. The bundle never
offered RS1 at the registration, since public_key_credential_parameters
defaults to an empty list, so only the applications that explicitly added
COSE_ALGORITHM_RS1 to that list are affected. They have to declare the service
themselves; autoconfiguration adds it back to the manager.