Manage existing passkeys in MapIdentityApi()

Split out of #67301.

That issue covers the two ceremonies, registering a passkey and signing in with one. Once a passkey exists there's nothing to manage it with: an app can't show the user which passkeys are on their account, rename one, or revoke the one on a phone they lost.

Three endpoints in the authorized `/manage/passkeys` group would cover it: `GET` to list, `PUT /{credentialId}` to rename, `DELETE /{credentialId}` to remove. All three look the passkey up on the signed-in user, so nobody can touch another account's passkey by guessing an ID. No new `UserManager` API is needed, `GetPasskeysAsync`, `GetPasskeyAsync`, `AddOrUpdatePasskeyAsync` and `RemovePasskeyAsync` all shipped in .NET 10.

Needs an API design for the response. `UserPasskeyInfo` carries the public key, the attestation object and the raw client data, none of which a client should see, so listing means picking a subset and naming a new type for it.