MFA for Admin Actions: GenerateUserCerts

[Joerger]

Require MFA for GenerateUserCerts (tctl auth sign).

Part of RFD 131.

Based off #35386 to use the same test helpers.

[Joerger]

@rosstimothy @Tener I made some changes to help unit tests pass and to make GenerateUserCerts not require admin MFA when the request already includes an MFA response. I plan on merging this tomorrow but wanted to give you guys a chance to do a quick re-review.

[Joerger]

A new test from Teleport Connect was failing in this PR, I found it was because MFA was being required for cert renewal, which is used in Teleport Connect Kube and Database "gateway" logic. There was also an issue with the wrong MFA prompt getting propagated to the API client. I fixed both issues in the latest 2 commits.

Notably, I decided to only require admin MFA for non-renewal cert generation requests, which encompasses both normal renewal and MFA verified reissue. So MFA will only be required for impersonation as intended. This will match the behavior of Web sessions, since we do not want to require MFA for frequent renewals.

Thanks @ravicious for your thorough Teleport Connect tests, I wouldn't have caught this issue otherwise.

Reviewers, I plan to merge this EOD as it's my last day before going OOO, but please open an issue or comment on this thread if you'd like any changes.