webauthn: split enclave mode in two.

The current flag now only enables a mode where things are active for
users with recoverable accounts and UV capabilities. A new feature flag
is added for the full feature set.

A number of changes are needed for this new mode:

   * GPM credentials are ignored unless the account is recoverable and
     the local system can create UV keys.
   * The enclave is not a candidate mechanism for create() calls either
     unless the same conditions hold.
   * A GPM PIN will never be enrolled for UV.
   * Fetching the account state now has a 1 second timeout.
   * Some error states now transition to an error UI rather than
     hitting NOTREACHED / NOTIMPLEMENTED

Bug: 40274370
Change-Id: Iddb724673765a040cd29d1ebc3115485389145ee
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5490561
Reviewed-by: Nina Satragno <nsatragno@chromium.org>
Commit-Queue: Adam Langley <agl@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1294281}