Allow identification of the microG implementation with AAGUID

Is your feature request related to a problem? Please describe.
Our company policy allows only specific FIDO2 authenticators. I could try to get my FP3 microG FIDO2 token whitelisted, but that requires that the server can actually identify microG. Right now, while supporting attestation in principle, microG sends the AAGUID "00000000000000000000000000000000" which it shares with the rest of the (not FIDO certified) world. So I don't even have a handle to request whitelisting.

Describe the solution you'd like
During a FIDO2 registration ceremony, microG should send a unique (made-up, but static) AAGUID. The corresponding attestation should be backed up at least with the attestation level "Self" (the attestation is signed with the private key itself, no external dependencies).

Describe alternatives you've considered
The alternative is to not use my e/OS/ phone inside company contexts.

Additional context
The attestation mode "Self" for attestations is specified in https://www.w3.org/TR/webauthn-2/#sctn-packed-attestation (need to produce only "alg" and "sig", no x5c).

If the build team were to maintain a self-signed CA to sign the (canned) attestation assertion during build time, microG could even provide an attestation on level "Basic" (signing with that X.509 certificate).

No files, tests, or entry points are named. Start by locating microG's FIDO2 registration and attestation handling, then trace how the AAGUID and packed attestation fields are produced; done means registrations identify microG with a static nonzero AAGUID and provide the requested self-attestation behavior.