Make primary authentication method (PACE/BAC) configurable

[Premeide]

What

Adds an authenticationMethod parameter to readPassport(...) letting callers
choose whether PACE or BAC is attempted first, with automatic fallback
to the other if the primary fails. Replaces the previous skipPACE: Bool flag.

public enum AuthenticationMethod { case BAC, PACE }
// defaults to .PACE — existing behavior unchanged

Why

Upstream hardcodes PACE-first. Some document/reader combinations are more
reliable starting with BAC; this gives integrators that control instead of an
all-or-nothing skip.

Also included

• Select the PACEInfo whose mapping type is GM (was: first match) — makes
  PACE selection deterministic and avoids picking an unsupported mapping.
• Run selectPassportApplication() once after auth completes (works for either
  path now that PACE/BAC are symmetric).
• Clearer logging for Active Authentication (supplied vs generated challenge)
  and Chip Authentication support detection.

Notes

• skipPACE is removed; the SPM example app is updated accordingly.