[WebAuthn] Replace deprecated origin= with allowed_origins=

[Copilot]

Summary of the problem

The webauthn gem emits a deprecation warning at boot: WebAuthn.origin= is deprecated and will be removed in future. Please use WebAuthn.allowed_origins= instead.

Describe your changes

• config/initializers/webauthn.rb: Replace all config.origin = assignments with config.allowed_origins = (array form) across staging, production, and development/test environments.
• spec/support/web_authn_support.rb: Update WebAuthn.configuration.origin → WebAuthn.configuration.allowed_origins.first to match the new API.

# Before
config.origin = "https://#{Credentials.fetch(:LIVE_URL_HOST)}"

# After
config.allowed_origins = ["https://#{Credentials.fetch(:LIVE_URL_HOST)}"]

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[WebAuthn] Handle deprecation message</issue_title>
<issue_description>```
DEPRECATION WARNING: WebAuthn.origin= is deprecated and will be removed in future. Please use `WebAuthn.allowed_origins=` instead that also allows configuring multiple origins per Relying Party

## Comments on the Issue (you are @copilot in this section)

<comments>
</comments>

• Fixes [WebAuthn] Handle deprecation message #12749

---

💬 Send tasks to Copilot coding agent from Slack and Teams to turn conversations into code. Copilot posts an update in your thread when it's finished.