Repository: eclipse-vertx/vertx-auth
Issue: WebAuthn : MetadataServiceImpl parseX5c method returns emptyList when x5c is null

### Version

Which version(s) did you encounter this bug ?

4.3.8

### Context

I encountered an exception which looks suspicious while I tried to verify my Webauthn authenticator using the metadataService.verify() method and when my authenticator attestationStatement (packed) looks like this : `"{"alg":"ES256"}"` leading to `empty chain` error when calling the MetaData.verifyMetadata() method.

```
private static List<X509Certificate> parseX5c(List<String> x5c) throws CertificateException {
    => List<X509Certificate> certChain = new ArrayList<>();

    if (x5c == null || x5c.size() == 0) {
      => return certChain;
    }

    for (String s : x5c) {
      certChain.add(JWS.parseX5c(BASE64_DECODER.decode(s)));
    }

    return certChain;
  }
```

```
    MetaData.verifyMetadata()
    # at this stage the x5c is an empty list
    => if (x5c != null) {
        // make a copy before we start
        x5c = new ArrayList<>(x5c);
        ...
    }
```

### Steps to reproduce

1. Verify a packed attestation with no x5c 
2. Call the metadataService.verify() method
3. Should not throw RuntimeException if MetaDataEntry is empty or OK

### Potential Solution

Do not create an empty list if the x5c is null.


Changed files:
vertx-auth-webauthn/src/main/java/io/vertx/ext/auth/webauthn/impl/metadata/MetaDataServiceImpl.java
vertx-auth-webauthn/src/test/java/io/vertx/ext/auth/webauthn/MetaDataServiceTest.java

diff --git a/vertx-auth-webauthn/src/main/java/io/vertx/ext/auth/webauthn/impl/metadata/MetaDataServiceImpl.java b/vertx-auth-webauthn/src/main/java/io/vertx/ext/auth/webauthn/impl/metadata/MetaDataServiceImpl.java
index 86636dfe..a31208f3 100644
--- a/vertx-auth-webauthn/src/main/java/io/vertx/ext/auth/webauthn/impl/metadata/MetaDataServiceImpl.java
+++ b/vertx-auth-webauthn/src/main/java/io/vertx/ext/auth/webauthn/impl/metadata/MetaDataServiceImpl.java
@@ -200,12 +200,12 @@ public class MetaDataServiceImpl implements MetaDataService {
   }
 
   private static List<X509Certificate> parseX5c(List<String> x5c) throws CertificateException {
-    List<X509Certificate> certChain = new ArrayList<>();
-
     if (x5c == null || x5c.size() == 0) {
-      return certChain;
+      return null;
     }
 
+    List<X509Certificate> certChain = new ArrayList<>();
+
     for (String s : x5c) {
       certChain.add(JWS.parseX5c(BASE64_DECODER.decode(s)));
     }
diff --git a/vertx-auth-webauthn/src/test/java/io/vertx/ext/auth/webauthn/MetaDataServiceTest.java b/vertx-auth-webauthn/src/test/java/io/vertx/ext/auth/webauthn/MetaDataServiceTest.java
index 36bfe5b9..559dbab5 100644
--- a/vertx-auth-webauthn/src/test/java/io/vertx/ext/auth/webauthn/MetaDataServiceTest.java
+++ b/vertx-auth-webauthn/src/test/java/io/vertx/ext/auth/webauthn/MetaDataServiceTest.java
@@ -29,6 +29,20 @@ public class MetaDataServiceTest {
     mds.verify(authenticator);
   }
 
+  @Test
+  public void testVerifyPackedWithEmptyX5C() {
+
+    // defaults
+    MetaDataService mds = new MetaDataServiceImpl(rule.vertx(), new WebAuthnOptions());
+
+    JsonObject packed = new JsonObject(data);
+    packed.getJsonObject("attestationCertificates").remove("x5c");
+
+    Authenticator authenticator = new Authenticator(packed);
+    // doesn't throw
+    mds.verify(authenticator);
+  }
+
   @Test
   public void testMDS3(TestContext should) {
     final Async test = should.async();