fix(jans-fido2): fix multiple issues in FIDO2 script - #14858

**1. Deadlock (critical):** getMetaDataConfiguration() could return early while still holding metaDataLoaderLock, before the try/finally that releases it. Moved lock acquisition to immediately wrap the entire method body, including the cached-value check, so the lock is always released.
**2. Robustness**: three call sites read self.metaDataConfiguration directly instead of through the lazy-loading accessor; switched to self.getMetaDataConfiguration() — no behavior change on the normal path, avoids passing None if ever called before the cache is warm.
**3. Sensitive data in logs:** removed print statements that logged tokenResponse, assertion/attestation result entities, decoded allowList cookie contents, and the raw new-credential object. Kept only HTTP status logging.
**4. Cookie dedup no-op:** add_credential_if_not_exists detected a duplicate credential ID but fell through and appended it anyway; now returns immediately on a match.
**5. Cookie parse failure:** getCookieValue could return the raw undecoded string (instead of []) if base64-decoding succeeded but JSON parsing failed, which would throw downstream when iterated. Now resets to [] on any parse failure.
**6. Missing cookie Path/SameSite:** persistCookie now sets an explicit Path=/ and SameSite=Lax, built as a raw Set-Cookie header (matching the existing convention in jans-config-api's OAuth2Resource.java) rather than Cookie.setAttribute, since that method isn't reliably available across Jakarta Servlet API versions.