fido: Enable ChromeOSAuthenticator to do user-presence requests

If a MakeCredential or GetAssertion request has set user verification
requirement to "discouraged", then send the request as presence-only.
ChromeOSAuthenticator will then do presence-only authentication for
this request.

Change-Id: I40f382368e8399c328e830984e433fd56f7cd6fc
Bug: b:144861739
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2124935Reviewed-by: Martin Kreichgauer <martinkr@google.com>
Commit-Queue: Martin Kreichgauer <martinkr@google.com>
Cr-Commit-Position: refs/heads/master@{#755236}

device/fido/cros/authenticator.cc

@@ -84,8 +84,12 @@ void ChromeOSAuthenticator::MakeCredential(CtapMakeCredentialRequest request,
   }
 
   u2f::MakeCredentialRequest req;
-  // Requests with UserPresence get upgraded to UserVerification.
-  req.set_verification_type(u2f::VERIFICATION_USER_VERIFICATION);
+  // Requests with UserPresence get upgraded to UserVerification unless
+  // verification is explicitly discouraged.
+  req.set_verification_type(
+      (request.user_verification == UserVerificationRequirement::kDiscouraged)
+          ? u2f::VERIFICATION_USER_PRESENCE
+          : u2f::VERIFICATION_USER_VERIFICATION);
   req.set_rp_id(request.rp.id);
   req.set_user_entity(
       std::string(request.user.id.begin(), request.user.id.end()));
@@ -177,8 +181,12 @@ void ChromeOSAuthenticator::GetAssertion(CtapGetAssertionRequest request,
   }
 
   u2f::GetAssertionRequest req;
-  // Requests with UserPresence get upgraded to UserVerification.
-  req.set_verification_type(u2f::VERIFICATION_USER_VERIFICATION);
+  // Requests with UserPresence get upgraded to UserVerification unless
+  // verification is explicitly discouraged.
+  req.set_verification_type(
+      (request.user_verification == UserVerificationRequirement::kDiscouraged)
+          ? u2f::VERIFICATION_USER_PRESENCE
+          : u2f::VERIFICATION_USER_VERIFICATION);
   req.set_rp_id(request.rp_id);
   req.set_client_data_hash(std::string(request.client_data_hash.begin(),
                                        request.client_data_hash.end()));