LG-10022: Avoid second MFA prompt for strict MFA requirement

[aduth]

🎫 Ticket

Follow-on revision for LG-10022 (#9124)

🛠 Summary of changes

Updates the second MFA reminder logic to avoid prompting the user if they are authenticating with a partner which requires stricter MFA requirements (i.e. phishing-resistant or PIV-only). This avoids an issue where the user may inadvertently "downgrade" their authentication method, since they may choose to add a second MFA which is less secure than what was required for the request. This could result in the user being prompted excessively to reauthenticate, since the less-secure method would not be valid for the authentication request, and they'd need to reauthenticate with the more secure method.

Per related Slack discussion, a separate ticket will be created to explore revisions to the session auth_method tracking to allow multiple, simultaneous valid authentications, so that a less-secure-but-more-recent authentication will not invalidate a more-secure-but-less-recent authentication.

📜 Testing Plan

It's easiest to test by setting an artificially low config override for sign-ins or account page, e.g. in config/application.yml:

second_mfa_reminder_sign_in_count: 1

1. Go to http://localhost:3000
2. Create an account using a phishing-resistant MFA method (security key, face or touch unlock, or PIV)
3. After account creation, sign out
4. Start the sample app in a separate terminal process
5. Go to http://localhost:9292/?aal=2-phishing_resistant
6. Click "Sign in"
7. Sign in
8. Observe that you are not prompted with the screen suggesting that you add a second authentication method

[jmdembe]

if each conditional returns false, why not || operator instead of multiple return false statements?

[aduth]

|| operator can work. It's a minor thing, but stylistically I felt the multiple returns are a little easier to scan as associated with the return value when split across multiple lines, though I preferred the || when it could be contained to a single line.

For example, in this code snippet, it's a little less obvious to me that user_has_multiple_mfa_methods? ties back to the return false, since it's so far apart.

return false if !IdentityConfig.store.second_mfa_reminder_enabled ||
  user_has_dismissed_second_mfa_reminder? ||
  second_mfa_enrollment_may_downgrade_for_service_provider_mfa_requirement? ||
  user_has_multiple_mfa_methods?