Add support for MFA for DB access

[smallinsky]

What

Introduce MFA per db connection.

UX Changes:

• Add support for MFA if user role db permission requires require_session_mfa
  • db connect

  tsh db connect proddb
  Tap any security key
  

  • db login

   tsh db login proddb
   Tap any security key
  

• tsh db connect databasename right now will call under the hood the databaseLogin function if db cert expired or if is missing. The tsh db login databasenama call is superflous if user wants to connect to the database using predefine db cli client binaries like postgresBin mysqlBin
• removed fetching db credentails for active databases during tsh db ls command.
• removed fetching db credentails for active databases during tsh login command.

[r0mant]

Have some code org suggestions. Also, can we test this somehow? We can't probably test real 2fa in tests but at least the business logic of requiring 2nd factor we should be able to.

[r0mant]

This may be fine but seems a little "arbitrary" TBH. What's the reasoning for this? Ideally, the comment should explain not "what" but "why".

[smallinsky]

@klizhentas Can I ask for UX changes review ?
The most significant change from the user perspective is:

tsh db connect databasename right now will call under the hood the databaseLogin function if db cert expired or if is missing. The tsh db login databasenama call is superflous if user wants to connect to the database using predefine db cli client binaries like postgresBin mysqlBin

So a user can just connect to a DB tsh db connect databasename without even login to it.

[russjones]

Bot.