log specific error when piv/cac second factor fails

[mitchellhenke]

so we can see what errors are happening on PIV/CACs used as a second factor, copied from what we do with the "Sign in with your Government Employee ID" event here: https://github.com/18F/identity-idp/blob/f12de9574723a4f31a2d392c8269c5b9908b62e7/app/forms/user_piv_cac_login_form.rb#L13-L14

Instead of:

{:success=>false,
 :errors=>{},
 :multi_factor_auth_method=>"piv_cac",
 :piv_cac_configuration_id=>nil,
 :key_id=>nil,
 :context=>"authentication"}

We'll have

 {:success=>false,
+ :errors=>{:type=>"certificate.invalid"},
  :multi_factor_auth_method=>"piv_cac",
  :piv_cac_configuration_id=>nil,
  :key_id=>nil,
  :context=>"authentication"}

[zachmargolis]

LGTM and thanks for the clear diff in the description! 🙏

[orenyk]

Amazing, thanks!