feat(jans-auth-server): populate forwarded client-context headers at the FIDO2 call sites

**Is your feature request related to a problem? Please describe.**
[#14801](https://github.com/JanssenProject/jans/issues/14801) makes the FIDO2 server accept X-Jans-Client-IP and X-Jans-Client-User-Agent and prefer them over getRemoteAddr() / User-Agent when recording metrics. That change is inert on its own: nothing sends the headers, so ipAddress stays the Auth Server's own address and userAgent stays Apache-HttpClient/4.5.14 (Java/17.0.20) until the callers are updated.

This issue covers the sending half. It is separate from [#14801](https://github.com/JanssenProject/jans/issues/14801) because the callers live in modules that build against the published jans-fido2-client artifact — they cannot compile against the new overloads until [#14801](https://github.com/JanssenProject/jans/issues/14801) has merged and republished, so the two cannot land in one PR.

**Describe the solution you'd like**
Pass the browser's IP and user agent on every Fido2ClientFactory proxy call that has the end user's request in hand, using the overloads added in [#14801](https://github.com/JanssenProject/jans/issues/14801):

1. jans-auth-server/server/src/main/webapp/auth/fido2/passkeys.xhtml and its backing bean — the path the Passkey Security Monitor's data actually comes from, so this is the one that visibly fixes the dashboard.
2. jans-casa/agama/project/lib/io/jans/casa/authn/FidoValidator.java — three call sites (lines 31, 54, 76).
3. docs/script-catalog/person_authentication/fido2-external-authenticator/Fido2ExternalAuthenticator.py — roughly ten authenticate / verify call sites across assertion and attestation.

Where a caller has no access to the originating HttpServletRequest, it should send nothing rather than a placeholder — [#14801](https://github.com/JanssenProject/jans/issues/14801) falls back to current behaviour when the headers are absent, and a fabricated value is worse than a missing one.

**Describe alternatives you've considered**
- Fold this into [#14801](https://github.com/JanssenProject/jans/issues/14801). Not possible in one PR: cross-module CI builds each module against published sibling jars, so jans-auth-server and jans-casa would be compiling against a jans-fido2-client that does not yet have the overloads.
- Update only passkeys.xhtml and stop there. It is the highest-value call site and would fix the dashboard, but it would leave Casa and the person-auth script silently recording the Auth Server as the client — the same wrong data, now inconsistently.
- Change the existing proxy signatures instead of adding overloads. Would force all callers to move in lockstep with the interface change, which is exactly the flag day the two-PR split avoids.

**Additional context**
- Depends on [#14801](https://github.com/JanssenProject/jans/issues/14801); cannot start until that has merged and the jans-fido2-client artifact has republished.
- Not in scope: demos/jans-chip/android/docs/authChallengeScript.java, which also calls Fido2ClientFactory. Worth a follow-up if the demo is still maintained.
- Header names and the trusted-caller list are decided in [#14801](https://github.com/JanssenProject/jans/issues/14801) — this issue just consumes them.