Returns the set of available policy-level authentication types, aligned with DeviceKeyPolicy. A type is considered available if the underlying device authenticator(s) exist: