Authentication: optional 2FA

Add a 2FA mode that supports 2FA for all users that have at least one matching challenge activated for themselves (e.g. OTP), but don’t force a fallback to the email challenge if no active challenges are available, but rather accept password only in that case.

['2fa' => 'optional']