Reject non-empty attStmt in none attestation format

[ScottHelme]

Per W3C WebAuthn spec §8.7 (None Attestation Statement Format):

"If attStmt is a properly formed attestation statement, verify that attStmt is an empty CBOR map."

Currently None::validateAttestation() returns true unconditionally without checking attStmt. This means an attestation object with fmt: "none" but arbitrary data in attStmt is silently accepted.

This adds a check that throws WebAuthnException::INVALID_DATA if attStmt is not empty:

if (\count($this->_attestationObject['attStmt']) > 0) {
    throw new WebAuthnException('invalid none attestation: attStmt must be empty', WebAuthnException::INVALID_DATA);
}

Fixes #126