fix(settings): skip passkey registration on a challenge mismatch
Because: * create() can return a credential signed over another challenge, so registration/finish fails and the device keeps an unknown passkey. This commit: * Compares the clientDataJSON challenge with the registration/start one. * On a mismatch, skips registration/finish and shows the add-passkey error. * Records the frontend error event with reason challenge_mismatch. * Documents challenge_mismatch in both Glean registry copies. Closes FXA-14286