Require reauthentication before adding a passkey or setting a password

[rolandVi]

In the Blazor template with Individual Accounts, adding a passkey now asks you to confirm who you
are first, with a credential the account already has.

What changed

The confirmation is a shared ReauthenticationPrompt component that offers whatever the account
actually holds: its password, one of its existing passkeys, or a re-challenge of a linked external
login. Confirming writes a data-protected cookie holding the user id and the current security stamp,
so changing the password or signing out everywhere invalidates it.

/Account/PasskeyCreationOptions moves into the /Manage group, which requires authorization, and
now refuses to hand out options without that marker. Left where it was, a cookie holder could fetch
options straight from it and skip the page entirely.

Confirming with a passkey goes through a new options endpoint that takes no username, and the
handler checks the asserted passkey belongs to the account that is already signed in.

SetPassword takes the same confirmation. It only gates on whether the account has a password yet,
so otherwise a cookie holder could set one and immediately use it to pass the new gate.

Resolves #66865.

[Copilot]

Pull request overview

Adds recent credential-based reauthentication before users can create permanent sign-in credentials.

Changes:

• Adds password, passkey, and external-login reauthentication flows.
• Protects passkey creation and password-setting endpoints.
• Adds template and Identity security-stamp tests.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
ReauthenticationPrompt.razor	Implements shared credential confirmation UI.
PasskeySubmit.razor.js	Adds passkey reauthentication support.
PasskeyReauthentication.cs	Stores and validates confirmation markers.
PasskeyOperation.cs	Adds the reauthentication operation.
SetPassword.razor	Requires confirmation before setting a password.
Passkeys.razor	Requires confirmation before passkey enrollment.
ChangePassword.razor	Clarifies session invalidation behavior.
IdentityComponentsEndpointRouteBuilderExtensions.cs	Secures and adds reauthentication endpoints.
template-baselines.json	Registers new generated template files.
BlazorTemplateTest.cs	Tests password confirmation for passkey creation.
FunctionalTest.cs	Tests security-stamp session behavior.
SignInManager.cs	Documents passkey enrollment security guidance.