Merge branch 'dm-session-delete-challenge' into 'master'

Delete correct key from `session` after authenticating using U2F

Closes #36096

See merge request !13499

app/controllers/concerns/authenticates_with_two_factor.rb

@@ -69,7 +69,7 @@ module AuthenticatesWithTwoFactor
     if U2fRegistration.authenticate(user, u2f_app_id, user_params[:device_response], session[:challenge])
       # Remove any lingering user data from login
       session.delete(:otp_user_id)
-      session.delete(:challenges)
+      session.delete(:challenge)
 
       remember_me(user) if user_params[:remember_me] == '1'
       sign_in(user)