Preserve AAGUID in AttestationObject::anonymize

[jschanck]

Updates our behavior to match Step 3 of the "If any authenticator returns success" branch of WebAuthn 5.1.3.22:

If the aaguid in the attested credential data is 16 zero bytes, credentialCreationData.attestationObjectResult.fmt is "packed", and "x5c" is absent from credentialCreationData.attestationObjectResult, then self attestation is being used and no further action is needed.
Otherwise:
Set the value of credentialCreationData.attestationObjectResult.fmt to "none", and set the value of credentialCreationData.attestationObjectResult.attStmt to be an empty CBOR map.

Previously we additionally zeroed the AAGUID when it was present. We also did not implement the self-attestation exemption.

[mozkeeler]

LGTM!