Document known browser bugs

[Firehed]

Offhand, the only thing I'm aware of is that some versions of Safari provide an erroneous relyingPartyId somewhere in the response payload when using certain hardware keys.

See https://github.com/joostd/Safari-CTAP1-RpIdHash/blob/main/README.md, https://bugs.webkit.org/show_bug.cgi?id=247344, WebKit/WebKit#6862

php > echo hash('sha256', 'https://www.gstatic.com/securitykey/origins.json');
a54672b222c4cf95e151ed8d4d3c767a6cc349435943794e884f3d023a8229fd

[Firehed]

Note: I'm no longer encountering that issue as of Safari 17, despite both linked issues still being listed as open as of now.