Adjustments to BBK requirements

[ianbjacobs]

Based on recent conversations:

• Clarify that a BBK should not be usable outside of the device where it was originally bound.
• Make explicit the implication that if a passkey is deleted then any associated BBK should also be deleted.

[Goosth]

Do we need to link BBK's to a specific passkey? I feel it raises a number of other questions:

• What does this mean if a Passkey is used on a different device and removed there?
• What about a new passkey being issued, since the browser/RP could not detect the previous Passkey anymore (cookie was deleted).
  It would be great to leave open the option of having a BBK in the future which we only want to use that as a possession factor without the direct link to Passkeys. So basically the BBK would work more along the principles of Server Side Cookies with CHIPS.

[ianbjacobs]

I have updated this pull request following the 8 May 2025 WPWG meeting.