Consume transient activation

[marcoscaceres]

We should probably require to consume transient activation to call identity.get(), as it shows UI.

Plus it would be otherwise annoying if sites could just pop up this dialog.

[RByers]

Agreed. Customers may have activation-less use cases (eg. click a button on one page that redirects to a different page where asking again would feel redundant). But I think we should start by requiring a tap/click and relax this only if there's a compelling use case.

Here's the corresponding issue tracking this in the chromium implementation.

[samuelgoto]

LGTM++

[marcoscaceres]

I think we want "fully active descendant of a top-level traversable with user attention"... it covers focus etc.