feat: validate related origins for cross-domain passkeys

[AlfioEmanueleFresta]

Enables related-origins validation so a passkey can be used from related domains the relying party lists. Stacked on the libwebauthn 0.8.0 bump. Note this adds the reqwest HTTP client to the dependency tree.

[AlfioEmanueleFresta]

Claude: I was tasked with researching the size and dependency delta this PR adds by enabling the reqwest-backed related-origins source. I built credentialsd in release on this branch and on the base bump branch and compared the binary:

	stripped	raw
base (no reqwest)	9.59 MiB	11.34 MiB
with reqwest	11.30 MiB	13.44 MiB
delta	+1.72 MiB (~18%)	+2.10 MiB

That is +28 crates (hyper, h2, hyper-rustls, tower, tower-http, and similar). libwebauthn already trims reqwest to rustls-tls-native-roots, http2, stream, and charset, so there is no cookies, blocking client, or native-tls, and the quinn entries in Cargo.lock are never compiled or linked (no HTTP/3 in the binary).

Net cost is the async HTTP/2 and rustls client core, roughly 1.7 MiB and 28 crates.