Support for MFA (multi-factor authentication)

[ingeborgoh]

Due to recent events the need to better secure the access to NAV has come up.

We would like to be able to demand Multi Factor Authentication before users are allowed to log in.

[lunkwill42]

Comments from nav-ref:

• Potentially, support for TOTP - Time-based One-time Password would cover this.
• Maybe "MFA must be used" should be read from LDAP and not apply to local user database
• Potentially, the whole MFA issue could be side-stepped by using REMOTE_USER and enabling MFA in Feide

[hmpf]

• [ ] https://github.com/Uninett/campus-tasks/issues/22
• [ ] #2688

[hmpf]

The docs for setting up REMOTE_USER with either oidc (#2708) or saml (#2740) has been checked and improved, that'll give us MFA for free.