Avoid registering the same authenticator twice

This passes existing credentials in the server response, to allow
the browser to prevent re-registering the same key for the same
user. Registering the same key multiple times doesn't seem to be
an issue technically; the user has likely got their keys mixed up.

- Chrome says "you don't need to register it again".
- Safari exits with an InvalidStateError.
- Firefox exits with a DOMException.

app/main/views/webauthn_credentials.py

@@ -19,7 +19,10 @@ def webauthn_begin_register():
             "name": current_user.email_address,
             "displayName": current_user.name,
         },
-        credentials=[],  # TODO: get from user
+        credentials=[
+            credential.to_credential_data()
+            for credential in current_user.webauthn_credentials
+        ],
         user_verification="discouraged",  # don't ask for PIN
         authenticator_attachment="cross-platform",
     )