Prevent auth type changing for any WebAuthn user

Previously we applied this restriction to Platform Admins, on the
assumption that all of them use a security key to log in. Rather
than making that assumption, we can explicitly check their login
method, which also supports rolling out the feature to more users.

app/main/forms.py

@@ -1009,14 +1009,10 @@ class BasePermissionsForm(StripWhitespaceForm):
             },
             login_authentication=user.auth_type
         )
-        # if the user is a platform admin then we don't allow you to change the login type. Unfortunately, since the
-        # login_authentication field is a radio field, the validation expects it to have a value, and the choices in it
-        # normally don't allow 'webauthn_auth'.
-        # If the user has webauthn_auth too, then we'll try and validate against that. We should never be changing
-        # auth of platform admin users, so just force the choices to be this.
-        # TODO: if the user is a regular user with webauthn_auth we will still show the radios, so if you edit that
-        # user's regular permissions you'll necessarily change their auth type as the value will be in the POST
-        if user.platform_admin:
+
+        # If a user logs in with a security key, we generally don't want a service admin to be able to change this.
+        # As well as enforcing this in the backend, we need to delete the auth radios to prevent validation errors.
+        if user.webauthn_auth:
             del form.login_authentication
         return form