[POC] WebAuthn CLI #1

[jenshenny]

See Shopify/rubygems.org#56 for details

This PR requests a custom url from RubyGems.org when asking for OTP. If email/password is given (in the signin case), it'll use basic auth, otherwise it'll use api key auth.

Potential blockers / changes

I have to pass down email/password down multiple levels (rubygems_api_request, ask_otp, webauthn_verification_url). Probably need to structure that better if this solution is chosen.

[bettymakes]

On your note of potential blockers / changes:
One minor step we can take is passing the email and password as a credentials hash instead. Although, we'd still need to pass it all the way down. I'll spend more time thinking on this.