fix(webauthncbor): reject data trailing the first cbor item (#762)