To prevent changes being merged into OATHAuth that are incompatible with WebAuthn, the former should depend on the latter (circularly) so phan and tests will ensure that no changes are merged that would break WebAuthn.

This would have prevented T303404: ArgumentCountError: Too few arguments to function MediaWiki\Extension\OATHAuth\OATHUserRepository::remove(), 2 passed in /srv/mediawiki/php-1.38.0-wmf.25/extensions/WebAuthn/src/HTMLForm/WebAuthnDisableForm.php on line 114 and exactly 3 expected, so marking as high priority.