Make two-factor auth actually work

Summary:
Ref T4398. Allows auth factors to render and validate when prompted to take a hi-sec action.

This has a whole lot of rough edges still (see D8875) but does fundamentally work correctly.

Test Plan:

• Added two different TOTP factors to my account for EXTRA SECURITY.
• Took hisec actions with no auth factors, and with attached auth factors.
• Hit all the error/failure states of the hisec entry process.
• Verified hisec failures appear in activity logs.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Maniphest Tasks: T4398

Differential Revision: https://secure.phabricator.com/D8886