Use UV=preferred for ReAuth WebAuthn challenge

Since ReAuth is a second factor credential, it is not necessary to
require UV here.  This was discussed with ReAuth folks.

Also, in practice, downstream clients disregard this because the U2F
protocol doesn't expose UV enforcement.

Author: darkfeline

google/oauth2/challenges.py

@@ -225,7 +225,7 @@ def _obtain_challenge_input_webauthn(self, metadata, webauthn_handler):
             challenge=self._unpadded_urlsafe_b64recode(challenge),
             timeout_ms=WEBAUTHN_TIMEOUT_MS,
             allow_credentials=allow_credentials,
-            user_verification="required",
+            user_verification="preferred",
             extensions=extension,
         )