Show both origin and RP ID in cross-origin contexts.

[iinuwa]

In cross-origin contexts, it is important to show the user both the RP and the origin they are visiting.

We should follow the WebAuthn advice about cross-origin UI, namely:

• calculate the registrable domain of the origin's hostname using Public Suffix List.
• For WebAuthn requests, if rp_id does not match origin, then send both origin's domain and the RP ID
• For WebAuthn requests (or protocols that do not have an RP ID equivalent), then if top_origin is set on the request, send both origin and top origin and display them accordingly.

Cf. 88b2e7c.