Allow platform-based self attestation with non-zero AAGUID when AttestationConveyancePreferenceOption "none" is used

[zacknewman]

In L3 platform-based authenticators are allowed AAGUIDs that are not all-zero even when credentialCreationData.attestationConveyancePreferenceOption is "none". As a result, there is no additional privacy obtained by replacing self attestation with none attestation. Specifically the steps describing constructCredentialAlg in § 5.1.3. should be changed from:

1. If the aaguid in the attested credential data is 16 zero bytes, credentialCreationData.attestationObjectResult.fmt is "packed", and "x5c" is absent from credentialCreationData.attestationObjectResult, then self attestation is being used and no further action is needed.

to

1. If the aaguid in the attested credential data is 16 zero bytes or authenticator is a platform authenticator, credentialCreationData.attestationObjectResult.fmt is "packed", and "x5c" is absent from credentialCreationData.attestationObjectResult, then self attestation is being used and no further action is needed.

[zacknewman]

Thinking of this more, if platform authenticators are excluded from the privacy-preserving practice of having their AAGUID replaced with all zeros when passed a "none" AttestationConveyancePreferenceOption, what is the point of replacing the attestation when self attestation is not used? Is AAGUID not strictly more privacy-disrespecting than any X.509 v3 certificate chain? Specifically, I'm thinking the following also seems to work:

1. If authenticator is a platform authenticator, then no further action is needed.
2. If the aaguid in the attested credential data is 16 zero bytes, credentialCreationData.attestationObjectResult.fmt is "packed", and "x5c" is absent from credentialCreationData.attestationObjectResult; then self attestation is being used and no further action is needed.

[pascoej]

I think this is the same as #1962.

[zacknewman]

Yeah, I think it is. I didn't know #1962 was still open until after I opened this and submitted a PR. #2058 added:

2. If authenticator is not a platform authenticator then replace the aaguid in the attested credential data with 16 zero bytes.

however that PR did not address the attestation aspect which #2150 does.