LG-10691: ensure user is authenticated in phone controller before accessing session

[amirbey]

🎫 Ticket

LG-10691

🛠 Summary of changes

Call confirm_two_factor_authenticated filters directly in controllers including PhoneOtpRateLimitable and PhoneOtpSendable concerns.

📜 Testing Plan

1. Start IDV
2. Select Send Link
3. Navigate to /test/telephony and open the link on the desktop in a new incognito window
4. Submit photos
5. On the capture complete screen (same Incognito window), navigate to /verify/phone
6. Verify user is directed to root/login page.

[soniaconnolly]

I checked where else PhoneOtpRateLimitable is used, and looks like we might need to add :confirm_two_factor_authenticated to ResendOtpController. Nevermind, you got it, I was looking in main. I'm curious why the action was put in the Concern originally.

LGTM. I ran the spec in main, saw it fail, and then ran it on this branch and saw it succeed.