Ref T4398. The major goals here is to let administrators strip auth factors in two cases:

• A user lost their phone and needs access restored to their account; or
• an install previously used an API-based factor like SMS, but want to stop supporting it (this isn't possible today).

• Used bin/auth list-factors to show installed factors.
• Used bin/auth strip with various mixtures of flags to selectively choose and strip factors from accounts.
• Also ran bin/auth refresh to verify refreshing OAuth tokens works (small OAuth vs OAuth2 tweak).