Add note about typical autocomplete combos for conditional UI

[MasterKale]

This PR includes a new note detailing two simple examples of "correct" autocomplete attributes that should reliably trigger conditional UI across most browsers.

Fixes #1982.

---

Preview | Diff

[MasterKale]

I'm not a huge fan of how the new Note renders, but I couldn't get it to indent one level closer to the left without tripping CI's HTML validator which complained that I tried to put a <div> inside a <dt>. The way it renders now CI is happy since the <div> is inside the accompanying <dd> that contains the subsequent logic block, "If silentlyDiscoveredCredentials is not empty":

[timcappalli]

LGTM

[arianvp]

drive-by question: Why does the webauthn token need to be at the end? This sounds like something many people will get wrong and I think most people don't read w3c specs but e.g. MDN.

I'm happy the note is there. I just wonder why it's needed in the first place

[nsatragno]

drive-by question: Why does the webauthn token need to be at the end? This sounds like something many people will get wrong and I think most people don't read w3c specs but e.g. MDN.

I'm happy the note is there. I just wonder why it's needed in the first place

The autofill attribute has a grammar with a strict order that parses right-to-left [1]. webauthn fit naturally with the existing process model at the end.

[1] https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#autofill

[nsatragno]

Thank you! Approved.

[emlun]

I would add autofill= to make the examples that tiny bit clearer, but this is fine as is too.

Suggested change

	- `"username webauthn"`
	- `"current-password webauthn"`
	- `autofill="username webauthn"`
	- `autofill="current-password webauthn"`

[emlun]

If I understood the HTML spec right it seems like autofill="webauthn" alone should also work (this will set the non-autofill credential type since it jumps to the Done step), is that right @nsatragno? If so, should we point that out too?

[nsatragno]

Yes, that should work too. Either pointing it out or not sounds good to me.

[MasterKale]

If I understood the HTML spec right it seems like autofill="webauthn" alone should also work (this will set the non-autofill credential type since it jumps to the Done step), is that right @nsatragno? If so, should we point that out too?

I think it'd be better to encourage here more use of proper autofill tokens so I'm inclined to not call this otherwise valid combination out...

[emlun]

Sounds fair. 🙂