feat(2fa): implement step-up authentication

[FrankApiyo]

Changes / Features implemented

Builds on #3207 (merged). Depends on onaio/ona-oidc#139.

#3207 puts sign-in behind a second factor; this gates individual account actions. A gated action is refused until the caller presents a single-use grant earned for that action. Each is opt-in via STEP_UP["ACTIONS"]: API and ODK token regeneration, email change, password change, the require-auth toggle and privacy consent. Profile gates fire only on an actual change, and the server-rendered settings and password-change pages are gated too, so they are not a way around the API.

Two modes via STEP_UP["MODE"]: in local, onadata owns the factor and the caller proves a code at /api/v1/totp/verify; in federated, an identity provider does — /api/v1/stepup/start returns the authorization URL and /api/v1/stepup/callback mints the grant. /api/v1/user/capabilities reports what the deployment can manage. A grant travels in the body or the X-Step-Up-Grant header, which CORS_ALLOW_HEADERS now allows.

Grants live in ona-oidc's stepup_grants; the audience whitelist stays here and its default covers every gated audience. Deploy checks catch misconfiguration: stepup.W001 (a gate bypassable under skip_gate), W002 (a gated audience /totp/verify cannot mint), W003 (an unrecognised MODE), W004 (local gating with ENABLE_TWO_FACTOR off). Documented in docs/two_factor.rst.

Steps taken to verify this change does what is intended

Tests cover policy, challenge dialects, capabilities, the federated round trip, the 409s, the deploy checks, and each gate's refused and grant-accepted paths — including the server-rendered pages and the CORS preflight. Codes come from a real HOTP implementation, and the single-use grant is exercised end to end. Verified against a live Keycloak: sign-in takes the password only; a gated action prompts for the factor and returns acr: gold with a fresh auth_time.

Worth a close read:

• Federated, no user has a local device, so skip_gate would wave every gated action through; federated mode always challenges instead.
• Only the token says who finished a step-up, so the callback verifies the subject, not just the state.
• The consent gate is on the effective post-write value, and a PUT cannot drop the record ungated.
• The single-use grant is spent once per request even though partial_update delegates to update and both run the gate.

Side effects of implementing this change

• TWO_FACTOR_ENROLMENT_REQUIRES_PASSWORD from feat(2fa): two-factor authentication with secrets encrypted at rest #3207 is removed: a first enrolment always needs the account password.
• /totp/status gains managedBy and capabilities; in federated mode the /totp management endpoints answer 409.
• A single request changing two gated values is unsatisfiable (one grant per request) and fails closed.
• requirements pin ona-oidc at the use common settings as default to prevent local_settings from being overidden by default_settings #139 branch head. Re-pin to a main SHA once that merges.

Before submitting this PR for review, please make sure you have:

• Included tests
• Updated documentation

Closes #