Add excludeCredentials to Passkey Creation Process

[Paul-Taiwo]

This PR introduces the excludeCredentials property to the passkey creation flow. This feature enhances the security and usability of the passkey creation process by preventing duplicate registrations of credentials associated with the same user.

[dagnelies]

Hi @Paul-Taiwo . Thank you very much for this PR. Although it's good, I slightly hesitate to accept it for various small reasons.

1. I think it's a better practice to just set the user ID in order to avoid multiple passkeys for the same user. It's also simpler than passing lists of credential IDs around. It also has the advantage of overwriting the existing credential (if there is any) which often provides better UX (overwrite instead of error) and may also help overwrite a problematic credential.
2. Less to document, understand, test, ...
3. Allowing multiple accounts, like one for work and a personal one, or for multiple users on the same device, sounds more sensible to me.

Actually, I'm more inclined to revert the random user.id generation (it was a hash of the username before) or add an option to add arbitrary properties.