What is the difference between ASPasskeyCredentialIdentity.userName and ASPasskeyCredentialIdentity.user ?
From https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialuserentity-displayname there should be only displayName.
userName vs user
These are both the same value. The user is inherited from the ASCredentialIdentity protocol, and userName is specific to ASPasskeyCredentialIdentity. The "Discussion" section of the documentation attempts to explain they are the same.
Note that these should generally be mapped to name (https://www.w3.org/TR/webauthn-2/#dom-publickeycredentialentity-name), not displayName. For example, iCloud Keychain doesn't use displayName.