Use the preferred otel.GetTracerProvider() idiom and create dedicated
Tracer instances as needed, which seems to be best practice.

Drop github.com/tstranex/u2f as the implementation, in favor of
github.com/duo-labs/webauthn.

This reverts commit f8bba073.

That version is incompatible with go 1.11 (debian).

The encoded public key is actually 65 bytes long, not 64.

This is shared code used by id/auth, id/keystore, and others. Unifying
it into its own package helps prevent drift among implementations.

Just use backoff.Retry() straight away without a wrapper.

Before, we weren't releasing the connection properly.

Simply by setting an empty bind DN.

Also simplifies handling of the connection pool itself, switching to
using deferred connects, and adds a test suite for misbehaving LDAP
servers to exercise failure modes.