Consider adding RSA validation to passkeys

Consider limiting the values of exponent and modulus in RSA creation for passkeys as larger values cause more allocations and CPU work.
https://github.com/dotnet/aspnetcore/blob/a55bb8b069aa2586e396e974f19b7ae638c8d4e5/src/Identity/Core/src/Passkeys/CredentialPublicKey.cs#L136-L142

It seems like the most common exponent value is 65537 with other common values being 3, 5, 17, and 257. We could probably add a check for these exact values, or something like `exponent < 100_000` if we want to be more accepting of the allowed values.

We should also verify that ECDsa doesn't need validation (assuming the underlying library would throw for lengths that don't fit the curve)
https://github.com/dotnet/aspnetcore/blob/a55bb8b069aa2586e396e974f19b7ae638c8d4e5/src/Identity/Core/src/Passkeys/CredentialPublicKey.cs#L162-L165

Edit: We probably shouldn't be artificially limiting what is allowed, as long as the OS supports it. If we really wanted to, we could create some user configurable policy to allow restricting what RSA/ECDsa is allowed.

Read src/Identity/Core/src/Passkeys/CredentialPublicKey.cs around lines 136-142 and 162-165 to understand RSA and ECDsa creation. Determine, with project guidance, whether validation or a configurable policy is wanted and define the supported behavior; done means the decision is documented and covered by relevant tests.

Written by the indexing model from the issue text.