set user_verification to discouraged

this is in line with our settings during registration. user verification
involves the browser popping up a PIN prompt. Since the user has already
entered their password correctly to get to this stage, we don't need any
more proof of Something They Know, so there's no need for this.

app/main/views/webauthn_credentials.py

@@ -86,7 +86,7 @@ def webauthn_begin_authentication():
 
     authentication_data, state = current_app.webauthn_server.authenticate_begin(
         credentials=user_to_login.webauthn_credentials_as_cbor,
-        user_verification=None,  # required, preferred, discouraged. sets whether to ask for PIN
+        user_verification="discouraged",  # don't ask for PIN
     )
     session["webauthn_authentication_state"] = state
     return cbor.encode(authentication_data)