webauthn: specify default triggering conditions for enclave on macOS.

We won't have GPM passkey support on iOS by the time that we ship it for
macOS, but many macOS users will use an iPhone and thus will be better
served (for now) with iCloud Keychain.

Thus this change attempts to figure out when it's reasonable to default
to GPM on macOS, and when we should pick iCloud Keychain.

GPM is a candidate for being the default create() destination when any
of the following is true:

  * iCloud Drive is disabled. (Suggesting that the user isn't signed
    into iCloud.)
  * The user has denied Chrome iCloud Keychain enumeration permission in
    the past.
  * There's a non-Apple device syncing to the account.
  * There are GPM passkeys in the account.

Bug: 40274370
Change-Id: I8ab55b8272a4b4c9eb515b109b65bebcc13cd1ba
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5657014
Commit-Queue: Adam Langley <agl@chromium.org>
Reviewed-by: Ken Buchanan <kenrb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1322512}