Support multiple Webauthn devices at once

[Cysioland]

Would be useful in case you eg. lost one of your hardware tokens but still had a backup

[roycewilliams]

+1. Allowing only a single WebAuthn device is an antipattern - having one key can actually be worse than no keys for some threat models (specifically, the "I want to use only WebAuthn for auth, but also want to not get locked out" case).