device/fido: fix complete filtering of an allow list.

By inspection, FilterAndBatchCredentialDescriptors always returns a
non-empty list of batches, but GetAssertion assumes that the case where
all credentials are filtered results in an empty list. When all
credentials were filtered, Chromium started sending empty allow-list
requests.

There was a test for this! But it didn't work: it tried to detect the
empty allow-list case by checking that account selection wasn't
triggered, but the request handler doesn't accept a response with
|num_credentials| > 1 if it wasn't supposed to be an empty allow-list
request. Thus the response is rejected which turns into
NOT_ALLOWED_ERROR, as the test was expecting.

Instead, have the virtual authenticator record the allow-list sizes and
check that no empty allow-list requests were sent.

Change-Id: I7fa1f8325b8ad06934183436916043926043fa99
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2293415
Commit-Queue: Adam Langley <agl@chromium.org>
Reviewed-by: Martin Kreichgauer <martinkr@google.com>
Auto-Submit: Adam Langley <agl@chromium.org>
Cr-Commit-Position: refs/heads/master@{#787446}