CollectedClientData.crossOrigin not referenced in RP ops

[emlun]

Both §7. WebAuthn Relying Party Operations instructs to validate CollectedClientData.origin and .topOrigin (if present), but do not reference crossOrigin at all.

Proposed Change

Add a step to verify crossOrigin in the RP operations. For example:

• If C.crossOrigin is present and set to true, verify that the Relying Party expects that this credential would have been created within an iframe that is not same-origin with its ancestors.