LG-11110: Allow user to reauthenticate with any MFA method in strict AAL2 setup

[aduth]

🎫 Ticket

LG-11110

🛠 Summary of changes

Fixes an issue where a user's MFA methods are filtered to PIV or phishing-resistant methods when prompted to reauthenticate after making a selection to set up a new, eligible strict AAL2 method, thereby preventing them from continuing if they don't already have one of these methods.

📜 Testing Plan

It can help to set reauthn_window to a low value in local development to force frequent reauthentication, e.g. 20 seconds in config/application.yml:

reauthn_window: 20

1. Go to http://localhost:3000 in local development
2. Create an account with phishable MFA method(s) (i.e. anything other than face/touch, PIV, or security key)
3. Start OIDC Sample App in a separate terminal process
4. Go to http://localhost:9292/?aal=2-phishing_resistant
5. Click "Sign in"
6. You should see an "additional authentication required" screen
7. Choose an authentication to add and click "Continue"
8. Continue to set up your new, stricter authentication method

Before: You would not have been successful, since you'd be prompted to reauthenticate, but you would see no options to use to reauthenticate.
After: You'll eventually be successful after reauthenticating with one of your existing methods.

👀 Screenshots

Before	After

[kevinsmaster5]

It looks good and testing proved the change works.