The first step of passwordless login is conditional mediation, where we send the browser a challenge, receive a response, and only then figure out who the user is. This requires sending a challenge without knowing which user it's for.

We generate WebAuthn challenges using the WebAuthnAuthenticator class, but constructing an instance of this class requires a User object, which we won't have in the passwordless login case. We should change WebAuthnAuthenticator to a service, and pass the User object in as a parameter to the methods that need it.

This will then allow us to add a method similar to startAuthentication() but for conditional mediation, with the following differences:

• allowCredentials is an empty array (rather than being an array of the user's credential IDs)
• The user verification flag is set to "required" (rather than "preferred")

(We don't need to do this for continueAuthentication(), because by that stage we'll know who the user is.)

• Make WebAuthnAuthenticator a service, wired up in ServiceWiring.php, no longer requiring a User object (or the passkeyMode flag) to construct it
• Add a User object parameter (and the passkeyMode flag) to the methods that need it
• Add a method that generates a conditional mediation challenge, without needing a User object