Add CIBA flow support, so users can do Sign in as

[dbalikhin]

Guest access for any device when you may or not want to add the guest device as a new authenticator. When passkeys are not enough.