Always confirm phone number with OTP during unsupervised identity verification

[mitchellhenke]

Currently, we send phone OTP codes as a random six character alphanumeric for both authentication and identity verification to meet the 800-63A enrollment code requirements. Phone OTPs as a second factor requires the OTP code to have 20 bits of entropy when generating it, and typically this means sending a six digit numeric code (as we have in the past).

Sending six character alphanumeric codes allows us to skip sending and confirming the enrollment code for a phone number during proofing if the user has previously confirmed that phone number in their account. The alphanumeric code has caused some issues though, so we are intending to revert to sending six digit numeric codes for authentication.

We are still required to meet the higher level of entropy for proofing enrollment codes, so this pull request includes changes to always require sending the proofing OTP and not allow skipping it, even if you're confirmed the phone previously. Doing this will allow us to send different kinds of codes for both authentication and proofing rather than always sending 6 alphanumeric.

---

Most of the changes in this PR are to the tests since they previously defaulted to not having to receive and enter a phone OTP. This included switching some specs to use TOTP as MFA instead of phone because the OTP rate limit is relatively low (at two) in test and I didn't want to increase it.

[mitchellhenke]

This is the crux and only thing needed in this PR to change the behavior, everything else is to support changing the specs

[aduth]

I wonder if there are other things we could simplify if we can always assume OTP confirmation will be required. At first I wondered if we could get rid of this variable altogether, though it appears it's necessary to push people to the review step if they're already done with this one.

Maybe we could still clean up some of the OTP-related redirect logic?

e.g.

identity-idp/app/controllers/idv/phone_controller.rb

Line 54 in a6a6a08

if phone_confirmation_required?

[mitchellhenke]

Potentially? I'm not sure though, the current flow is:

1. PhoneFinder
2. Confirm Phone via OTP if needed

so the stuff we can delete in the app might be more limited. The tests are a different story though.

[zachmargolis]

LGTM

[orenyk]

I don't know this code well enough to approve but just wanted to say that I'm SO glad that we're moving back towards 6-digit OTP for MFA 🙌 . Nice work @mitchellhenke!