SignInManager: return SignInResult.Failed for expired passkey session challenge

[GrantTotinov]

SignInManager: return SignInResult.Failed for expired passkey session challenge

• You've read the Contributor Guide and Code of Conduct.
• You've included unit or integration tests for your change, where applicable.
• You've included inline docs for your change, where applicable.
• There's an open issue for the PR that you are making.

---

Summary of the changes

Return SignInResult.Failed for expired or missing passkey session challenge.

Description

Passkey sign-in currently throws when the server-side session challenge is missing or expired, resulting in an unhandled exception instead of a controlled sign-in failure.

This change ensures that missing or invalid passkey session state results in SignInResult.Failed, aligning the behavior with other SignInManager authentication flows.

Changes

• Handle missing or expired passkey session state in PasskeySignInCoreAsync
• Prevent InvalidOperationException for recoverable authentication failures
• Add unit test covering expired/missing session scenario

Testing

• Added PasskeySignInReturnsFailedWhenSessionChallengeHasExpired
• Verified existing passkey tests pass locally

Fixes #67410

[Copilot]

Pull request overview

Updates ASP.NET Core Identity’s SignInManager passkey sign-in flow so an expired/missing passkey session challenge results in a controlled SignInResult.Failed outcome instead of an unhandled exception, and adds a unit test for the scenario.

Changes:

• Add an early check in PasskeySignInCoreAsync to return SignInResult.Failed when passkey session state is missing/invalid.
• Add a new unit test covering the “expired/missing session challenge” passkey sign-in scenario.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
src/Identity/Core/src/SignInManager.cs	Adds early failure handling for missing/invalid passkey session state during passkey sign-in.
src/Identity/test/Identity.Test/SignInManagerTest.cs	Adds a new test to validate passkey sign-in returns Failed when the passkey session challenge is expired/missing.