Add FIDO AUTHENTICATOR section and explain a bit how FIDO works. The

Add FIDO AUTHENTICATOR section and explain a bit how FIDO works. The
wording came mostly from the 8.2 OpenSSH release notes, addapted to
fit the man page.
Then move the -O bits into the new section as is already done for
CERTIFICATES and MODULI GENERATION.
Finally we can explain the trade-offs of resident keys.
While here, consistently refer to the FIDO thingies as "FIDO
authenticators", not "FIDO tokens".

input & OK jmc, naddy