Allow installs to require multi-factor authentication for all users

Summary: Ref T5089. Adds a security.require-multi-factor-auth which forces all users to enroll in MFA before they can use their accounts.

Test Plan:
Config:

{F159750}

Roadblock:

{F159748}

After configuration:

{F159749}

• Required MFA, got roadblocked, added MFA, got unblocked.
• Removed MFA, got blocked again.
• Used bin/auth strip to strip MFA, got blocked.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T5089

Differential Revision: https://secure.phabricator.com/D9285