feat(auth): send WAF challenge cookie on passkey sign-in
Because: - The Fastly WAF challenge needs the cookie on passkey sign-in requests before the WAF rule can cover those routes This commit: - Includes credentials on passkey authentication start/finish in auth-client - Allows CORS credentials on both routes in auth-server Closes #FXA-14013