Require an "ordinary" provider to use Backup Codes

[iandunn]

Fixes #158

This preserves the code from #75, but goes further to disable the provider for the user until they have an "ordinary" provider enabled.

"Ordinary" means that the provider is intended for normal use (like TOTP), as opposed to a fallback provider (like Backup Codes) that is only used when the user can't access their ordinary device.

Testing

1. Enable TOTP and Backup Codes
2. Disable TOTP. You should see the elevated privileges warning on the front- and back-ends. The Backup Codes provider will also show as disabled on the front- and back-ends.

Notes

• If WebAuthn is enabled and TOTP is disabled, the custom UI will still show "Two-Factor auth" (TOTP) as disabled. That will be fixed by Add WebAuthn UI stub #87 and subsequent PRs.

• This doesn't automatically update the Two_Factor_Core::ENABLED_PROVIDERS_USER_META_KEY database value, so, there are some normal situations where the two values are out of sync.

  For example, when a new user sets up TOTP and Backup Codes through the custom UI. In that scenario, the db value will only have TOTP, but in memory it'll have Backup Codes added. If there's a subsequent save to the value, then the database will be updated to reflect the value in memory.

  I don't think that'll cause any tangible issues in practice, but it's worth mentioning. If we want, we could add extra code to update the DB, but the time vs benefit tradeoff doesn't seem worth it to me at this point.

[iandunn]

Nevermind @dd32 , @adamwoodnz . I'm switching this back to draft for now, to fix a test and also because it'll be hard to see the changes in the diff until #161 is merged.

[iandunn]

@adamwoodnz , @dd32 ok, this is ready for review now.