cryptenroll: handle FIDO2 tokens gracefully that lack requested features

cryptenroll: handle FIDO2 tokens gracefully that lack requested features

Let's try to handle keys gracefully that do not implement all features
we ask for: simply turn the feature off, and continue.

This is in particular relevant since we enroll with PIN and UP by
default, and on devices that don't support that we should just work.

Replaces: #18509