Don't set up 2fa without authenticating first

[jgsmith-usds]

Why:
If someone creates an account and adds their piv/cac
and then logs out, on subsequent login, they had the
option of adding a phone number when prompted for
their piv/cac. This allowed someone with the username
and password to bypass the piv/cac second factor and
set the phone, which would then be used as the
second factor.

How:
Only allow phone setup during account creation or after
authenticating with a second factor.

Hi! Before submitting your PR for review, and/or before merging it, please
go through the following checklist:

• For DB changes, check for missing indexes, check to see if the changes
  affect other apps (such as the dashboard), make sure the DB columns in the
  various environments are properly populated, coordinate with devops, plan
  migrations in separate steps.

• For route changes, make sure GET requests don't change state or result in
  destructive behavior. GET requests should only result in information being
  read, not written.

• For encryption changes, make sure it is compatible with data that was
  encrypted with the old code.

• For secrets changes, make sure to update the S3 secrets bucket with the
  new configs in all environments.

• Do not disable Rubocop or Reek offenses unless you are absolutely sure
  they are false positives. If you're not sure how to fix the offense, please
  ask a teammate.

• When reading data, write tests for nil values, empty strings,
  and invalid formats.

• When calling redirect_to in a controller, use _url, not _path.

• When adding user data to the session, use the user_session helper
  instead of the session helper so the data does not persist beyond the user's
  session.

• When adding a new controller that requires the user to be fully
  authenticated, make sure to add before_action :confirm_two_factor_authenticated.

[monfresh]

Good catch! Can we write these tests please?

• totp_enabled but not phone enabled should not be able to access phone_setup page directly after signing in with just email and password
• piv_cac_enabled but not phone enabled should not be able to access phone_setup page directly after signing in with just email and password
• totp_enabled but not phone enabled should not be able to access phone_setup page indirectly by visiting login/two_factor/sms after signing in with just email and password
• piv_cac_enabled but not phone enabled should not be able to access phone_setup page indirectly by visiting login/two_factor/sms after signing in with just email and password
• totp_enabled but not phone enabled should not be able to access phone_setup page indirectly by visiting login/two_factor/voice after signing in with just email and password
• piv_cac_enabled but not phone enabled should not be able to access phone_setup page indirectly by visiting login/two_factor/voice after signing in with just email and password

[monfresh]

These match? changes seem to be unrelated Rubocop fixes. Can we do these in a separate PR?

[monfresh]

I know you did this for testing purposes, but flagging it to remove the true.

[jgsmith-usds]

Yeah - I realized this crept in when I saw some of the failing tests.

[monfresh]

LGTM