Audit the U2F API

Similar to legacy/trac#26614 (moved), we should audit the U2F API implementation that is enabled with the security.webauth.u2f pref.

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information