Extract mixin for common MFA deletion behaviors

[aduth]

🎫 Ticket

Related to LG-14052

🛠 Summary of changes

Refactors to create a new MfaDeletionConcern#handle_successful_mfa_deletion method. This builds upon #11795, where the method was initially introduced to handle "Undo" behaviors associated with a mismatched WebAuthn configuration.

Deleting a multi-factor authentication method always incurs the following:

• Creating a user history event
• Revoking remembered device
• Dispatching a RISC security event

Previously, these were duplicated across controllers for each method, which creates risk of human error for failing to account for one or more of these actions.

As an example, refactoring this behavior reveals that we don't have a user event associated with deleting backup codes, which became obvious when abstracting this method with a required event_type keyword argument. This will be addressed in a follow-up ticket.

📜 Testing Plan

Verify no regressions of impacted behavior, and that existing test coverage passes.

[aduth]

I've pushed a rebase of the branch after merging #11795. Since #11795 separately included the mixin method as part of its implementation, the scope of this branch is now limited to using the mixin consistently across other MFA method controllers.

[aduth]

As an example, refactoring this behavior reveals that we don't have a user event associated with deleting backup codes, which became obvious when abstracting this method with a required event_type keyword argument. This will be addressed in a follow-up ticket.

Ticket: LG-15602