upstream: Add FIDO AUTHENTICATOR section and explain a bit how FIDO

upstream: Add FIDO AUTHENTICATOR section and explain a bit how FIDO

works. The wording came mostly from the 8.2 OpenSSH release notes, addapted
to fit the man page. Then move the -O bits into the new section as is already
done for CERTIFICATES and MODULI GENERATION. Finally we can explain the
trade-offs of resident keys. While here, consistently refer to the FIDO
thingies as "FIDO authenticators", not "FIDO tokens".

input & OK jmc, naddy

OpenBSD-Commit-ID: dd98748d7644df048f78dcf793b3b63db9ab1d25