clarify "authenticator model": RPs may perform feature-based authenticator selection

[equalsJeffH]

clarify "authenticator model": RPs may perform feature-based authenticator selection with both

1. navigator.credentials.create() (which invokes webauthn's #createCredential), and
2. navigator.credentials.get() (which invokes webauthn's #getAssertion).

In (1), options stipulating "require resident key" and "require user verification" are expected to be passed (see also #536, #524), e.g., ultimately to CTAP's authenticatorMakeCredential command.

In (2), options stipulating "require user verification", "require user presence test" are expected to be passed (see also #629, #524), e.g., ultimately to CTAP's authenticatorGetAssertion command.

[emlun]

In (2), options stipulating "require user verification", "require user presence test" are expected to be passed

Current language specifies to always perform a user presence test (unless user verification is performed), so the latter option does not currently exist (as discussed in https://github.com/w3c/webauthn/issues/629#issuecomment-336574658).

[selfissued]

This is not actionable without a PR. @equalsJeffH - do you plan to create one soon - ideally during this week's FIDO plenary?

[equalsJeffH]

yes i plan to "create one soon" but meeting(s) I'm participating in have priority.

[equalsJeffH]

fixed by PR #782