Build a RuleType to check that 2FA is enabled

[puerco]

Let's create a RuleType that verifies and alerts when two factor auth in an organization is turned off

[evankanderson]

I'm not sure that we have a way to check policy on the organization level at the moment (e.g. we don't have an Organization entity)

[puerco]

Also: Changing the setting also does not produce a webhook call so we need to find another way to monitor it.

[evankanderson]

@ethomson for prioritization as an epic