feat(session): Passkey Check API with relation tables (#11858)

# Which Problems Are Solved

As part of #11035 , this PR implements the Passkey check logic for
session validation

# How the Problems Are Solved

  - Refactor webauth FinishLogin to support new domain model
  - Add webauth config to defaults
  - Implement passkey check logic and tests
- Manual transaction management to avoid stalling the DB while
FinishLogin callback is executed
- Update passkey Type condition to allow passing a text operation
(equal, contains, etc..)

# Additional Context

This is a cherry-picked PR + minor changes, coming from
https://github.com/zitadel/zitadel/pull/11164
- Relates to #11035

---------

Co-authored-by: Fabienne Bühler <[email protected]>
Co-authored-by: Gayathri Vijayan <[email protected]>

internal/command/session_webauhtn.go

@@ -80,7 +80,7 @@ func (c *Commands) CheckWebAuthN(credentialAssertionData json.Marshaler) Session
 		if err != nil && (credential == nil || credential.ID == nil) {
 			return nil, err
 		}
-		_, token := domain.GetTokenByKeyID(webAuthNTokens.tokens, credential.ID)
+		token := domain.GetTokenByKeyID(webAuthNTokens.tokens, credential.ID)
 		if token == nil {
 			return nil, zerrors.ThrowPreconditionFailed(nil, "COMMAND-Aej7i", "Errors.User.WebAuthN.NotFound")
 		}

internal/command/user_human_webauthn.go

@@ -462,7 +462,7 @@ func (c *Commands) finishWebAuthNLogin(ctx context.Context, userID, resourceOwne
 		return nil, nil, 0, err
 	}
 
-	_, token := domain.GetTokenByKeyID(tokens, credential.ID)
+	token := domain.GetTokenByKeyID(tokens, credential.ID)
 	if token == nil {
 		return nil, nil, 0, zerrors.ThrowPreconditionFailed(nil, "COMMAND-3b7zs", "Errors.User.WebAuthN.NotFound")
 	}