Defer adding Session Key on-chain until first on-chain action.

[gakonst]

Currently, we genreate a scoped session key & immediately add it to the keychain. It might be worth adding a utility which generates the session key & signs over it, but defers putting the message on-chain / combines it with the first on-chain action.

So e.g the E2E flow would be:

1. Passkey popup -- signs adding a new session key
2. Sign action w/o popup w/ session key
3. Submit (1) & (2) in bundle, (1) will add the session key in the contract, and (2) will succeed because that key will be valid then.

[gakonst]

This also applies for the user's PassKey initialization during onboarding.