Support SSO MFA for headless

[atburke]

This change adds support for SSO MFA in headless mode.

Follow-up to #53166.

Changelog: Added support for SSO MFA as a headless MFA method

[ravicious]

I think this might have introduced a regression where rejecting a headless login causes a panic (#58864).

2026-01-27T15:38:10.522+01:00 INFO  "http: panic serving 127.0.0.1:49464: runtime error: invalid memory address or nil pointer dereference

goroutine 6747436 [running]:
net/http.(*conn).serve.func1()
	net/http/server.go:1943 +0xb4
panic({0x10ee85f20?, 0x116b50be0?})
	runtime/panic.go:783 +0x120
github.com/gravitational/teleport/lib/client.(*MFAChallengeResponse).GetOptionalMFAResponseProtoReq(0x14002ee0640?)
	github.com/gravitational/teleport/lib/client/weblogin.go:139 +0x1c
github.com/gravitational/teleport/lib/web.(*Handler).putHeadlessState(0x14002ee0640?, {0x110703b50?, 0x14003ac6cc0?}, 0x14002ee0640, {0x14001a28940?, 0x19?, 0x14003639360?}, 0x14003639360)
	github.com/gravitational/teleport/lib/web/headless.go:74 +0xfc
github.com/gravitational/teleport/lib/web.(*Handler).bindDefaultEndpoints.(*Handler).WithAuth.func168({0x1106fe860, 0x14004992060}, 0x14002ee0640, {0x14001a28940, 0x1, 0x1})
	github.com/gravitational/teleport/lib/web/apiserver.go:5198 +0xb4
github.com/gravitational/teleport/lib/web.(*Handler).bindDefaultEndpoints.(*Handler).WithAuth.MakeHandler.MakeHandlerWithErrorWriter.func373({0x1106fe860, 0x14004992060}, 0x14002ee0640, {0x14001a28940, 0x1, 0x1})
…

I suppose req.MFAResponse might be nil but we attempt to read it on line 74.

[ravicious]

The Web UI uses the same endpoint to approve and reject a headless request, but rejecting a request should not require MFA.

Edit: Fix here. #63189

teleport/web/packages/teleport/src/services/auth/auth.ts

Lines 245 to 264 in 7b3fe4c

	headlessSsoAccept(mfa: MfaState, transactionId: string) {
	return mfa.getChallengeResponse().then((res: MfaChallengeResponse) => {
	const request = {
	action: 'accept',
	mfaResponse: res,
	// TODO(Joerger): DELETE IN v19.0.0, new clients send mfaResponse.
	webauthnAssertionResponse: res.webauthn_response,
	};
	return api.put(cfg.getHeadlessSsoPath(transactionId), request);
	});
	},
	headlessSSOReject(transactionId: string) {
	const request = {
	action: 'denied',
	};
	return api.put(cfg.getHeadlessSsoPath(transactionId), request);
	},