Due to the Mojo struct member being non-optional, the CtapGetAssertionRequest::allow_list is set to empty list even if `allowCredential` undefined.

Ideally, |allow_list| should be made non-optional -- neither the WebAuthn, nor the CTAP2 differentaties between the list missing and being empty.