Get pending passkey update

Return the passkey this session can update to the new domain after using it within the last five minutes, or null.