Credential descriptor for allowCredentials/excludeCredentials.
Base64url-encoded credential ID
Transport hints (e.g., "internal", "usb", "nfc", "ble", "hybrid")
Credential type, always "public-key"