Allow installs to require multi-factor authentication for all users

Summary: Ref T5089. Adds a security.require-multi-factor-auth which forces all users to enroll in MFA before they can use their accounts.

Test Plan:
Config:

Roadblock:

After configuration:

• Required MFA, got roadblocked, added MFA, got unblocked.
• Removed MFA, got blocked again.
• Used bin/auth strip to strip MFA, got blocked.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T5089

Differential Revision: https://secure.phabricator.com/D9285