Unauthenticated login via enabled default WebAuthn callback

Authentication bypass in Quarkus before 3.15.3.1 allows remote attackers to obtain a login cookie through a default WebAuthn endpoint. The quarkus-security-webauthn module leaves /q/webauthn/callback enabled when an application supplies custom login and registration endpoints, and the callback creates a SecurityIdentity from an attacker-supplied user name. Exploitation requires the WebAuthn extension and custom endpoints; the resulting identity has no roles by default but can inherit an existing user's roles from application logic.