LG-10286: Allow AAL2-restricted sign in to choose another option

[aduth]

🎫 Ticket

LG-10286

🛠 Summary of changes

Updates AAL2 strict authentication requests to use a more standardized user flow, allowing a user to use all available methods supported for the request.

Previously, it would not be possible to use Face or Touch Unlock to sign in to a partner requesting phishing-resistant MFA.

With these changes, the user will always be given the option to "Choose another authentication method" when prompted for their MFA. If MFA options are limited due to request parameters of the partner, a warning will be shown on the MFA selection screen explaining why the options are limited.

Draft: Merges to #8834

📜 Testing Plan

1. Go to http://localhost:3000
2. Create an account with PIV/CAC as your MFA
3. From account dashboard, click "Add Face or Touch Unlock" and complete enrollment
4. From account dashboard, click "Security key' and complete enrollment
5. From account dashboard, click "Forget all browsers" and complete this flow
6. Sign out
7. With example sample app running in a separate process, go to http://localhost:9292
8. Under Options, select "Phishing-resistant AAL2" under "Authentication Assurance Level (AAL)"
9. Click "Sign in"
10. Sign in to the account you created
11. Confirm that you are able to use any of your MFA methods to sign in

👀 Screenshots

Phishing Resistant Required:

Screen	Before	After
MFA selection	N/A
PIV authentication
Security Key authentication
Face/Touch authentication	N/A

PIV/CAC Only:

Screen	Before	After
PIV authentication
MFA selection	N/A

[mdiarra3]

LGTM

[aduth]

Since this depends on / merges to #8834, I'm going to wait for that to be approved and merged, then rebase this against main for merge.