Consider change hardwareBound from boolean to string

[jht5945]

In the spec hardwareBound is boolean, consider user string (enum):

• required - MUST use hardware backed
• preferred - use hardware backed if available, use software otherwise
• discouraged - DO use software backed

[kdenhartog]

Hmm, this seems like a reasonable idea. If I remember correctly there's some semantics that are very similar to this in Webauthn API which I'll likely reuse here if it makes sense.

Thanks for the suggestion.