The MFA required check added to the Auth server in
#24250 is now
only performed if the `RouteToCluster` indicates that the request
is for the local cluster and not a remote cluster. When the root
cluster checks if mfa is required to a resource in another cluster
it would always return a not found error since the resource didn't
exist in the root backend. This results in the behavior described
in #25619.

This step is now skipped for any resources in another cluster to allow
certificates for remote cluster resources to be generated by the root.
`tsh` detects that a resource is a leaf cluster and will first call
`proto.AuthService/IsMFARequired` on the leaf cluster before requesting
certificates from the root cluster to prevent a user from being
prompted to complete an MFA ceremony if one is not required.

Closes #25619