`_checkOrigin()` accepts lookalike domains due to missing domain boundary check

[ScottHelme]

The _checkOrigin() method validates the origin by checking if the RP ID is a suffix of the host (source):

return \preg_match('/' . \preg_quote($this->_rpId) . '$/i', $host) === 1;

This matches any hostname ending with the RP ID string, without requiring a domain boundary. For RP ID example.com, the following origins
incorrectly pass validation:

• https://evil-example.com (lookalike domain)
• https://evilexample.com (lookalike domain)

The W3C WebAuthn Level 2 spec (§7.1 Step 5 / §7.2 Step 9) requires the RP ID to be equal to the origin's effective domain, or the origin's
host to be a subdomain of the RP ID — meaning a dot boundary is required.

Proposed fix:

if (\strcasecmp($host, $this->_rpId) === 0) {
    return true;
}
return \str_ends_with(\strtolower($host), '.' . \strtolower($this->_rpId));

This accepts example.com (exact match) and www.example.com (subdomain at dot boundary), while rejecting evil-example.com and evilexample.com (lookalikes).

[ScottHelme]

Just a heads-up for anyone landing here: we've published a security-focused fork of this library as report-uri/passkeys-php

It already includes this fix, along with several other hardening changes. Huge thanks to @lbuchs for the original work!

This PR is still very much open for upstream consideration, but the fork is available in the meantime for anyone who needs the change today.