Use API flag to give users access to WebAuthn

This allows us to roll out the feature to other users. Note that
the flag is also "True" if the user has "webauthn_auth" as their
auth type, so this is compatible with the more fine-grained check
we have on the authentication parts of the feature. We could do a
more explicit "can_use_webauthn or webauthn_auth" check here, but
the idea is that we'll be able to get rid of this flag eventually,
so I've optimised for brevity instead.

I've modified a couple of the unhappy-path tests to make it more
explicit that the flag is false, since it can be true for Platform
Admins and "normal users" alike.

tests/app/main/views/test_user_profile.py

@@ -44,7 +44,7 @@ def test_overview_page_shows_disable_for_platform_admin(
     (1, 'Security keys 1 registered Change'),
     (2, 'Security keys 2 registered Change'),
 ])
-def test_overview_page_shows_security_keys_for_platform_admin(
+def test_overview_page_shows_security_keys_if_user_they_can_use_webauthn(
     mocker,
     client_request,
     platform_admin_user,
@@ -358,7 +358,13 @@ def test_can_reenable_platform_admin(client_request, platform_admin_user):
         assert session['disable_platform_admin_view'] is False
 
 
-def test_normal_user_doesnt_see_security_keys(client_request):
+def test_user_doesnt_see_security_keys_unless_they_can_use_webauthn(
+    client_request,
+    platform_admin_user
+):
+    platform_admin_user['can_use_webauthn'] = False
+    client_request.login(platform_admin_user)
+
     client_request.get(
         '.user_profile_security_keys',
         _expected_status=403,
@@ -455,9 +461,16 @@ def test_manage_security_key_page_404s_when_key_not_found(
     (".user_profile_confirm_delete_security_key", "post"),
     (".user_profile_delete_security_key", "post"),
 ])
-def test_non_platform_admin_user_cant_manage_security_keys(
-    client_request, webauthn_credential, endpoint, method
+def test_cant_manage_security_keys_unless_can_use_webauthn(
+    client_request,
+    platform_admin_user,
+    webauthn_credential,
+    endpoint,
+    method
 ):
+    platform_admin_user['can_use_webauthn'] = False
+    client_request.login(platform_admin_user)
+
     if method == "get":
         client_request.get(
             endpoint,

tests/app/main/views/test_webauthn_credentials.py

@@ -33,14 +33,14 @@ def webauthn_authentication_post_data(fake_uuid, webauthn_credential, client):
     })
 
 
-@pytest.mark.parametrize('endpoint', [
-    'webauthn_begin_register',
-])
-def test_register_forbidden_for_non_platform_admins(
+def test_begin_register_forbidden_unless_can_use_webauthn(
     client_request,
-    endpoint,
+    platform_admin_user,
+    mocker,
 ):
-    client_request.get(f'main.{endpoint}', _expected_status=403)
+    platform_admin_user['can_use_webauthn'] = False
+    mocker.patch('app.user_api_client.get_user', return_value=platform_admin_user)
+    client_request.get('main.webauthn_begin_register', _expected_status=403)
 
 
 def test_begin_register_returns_encoded_options(