feature: allow changing user authentication challenges

[greenpau]

A clear and concise description of what you want the system to do.

Currently, when user attempts to login the users will be prompted for the password first. Then,
if MFA (application or hardware) is configured for the user, the user will be prompted to authenticate with
either of them.

If Caddyfile contains require mfa in transform user and the MFA is not configured, then
as part of user login, the user will be required to onboard MFA token. It could be Authenticator
application token, hardware token, e.g. Yubico, or device-associated token, e.g. passkey.

The logic could be found in these places.

https://github.com/greenpau/go-authcrunch/blob/09467b0aaa58395b95d6940383668058325c8fdd/pkg/identity/user.go#L598-L634

https://github.com/greenpau/go-authcrunch/blob/09467b0aaa58395b95d6940383668058325c8fdd/pkg/authn/handle_http_sandbox.go#L447-L522

To summarize, there are two pathways to get authentication:

1. password only
2. password, then MFA (either app or hardware)

In the code, these challenges are being referred to as password and mfa.

Recently, I introduced two more challenges that provide more granularity: totp and u2f.

This feature introduces a more flexible way to challenge a user during authentication process.

It would allow a user to authenticate via passkey or yubico token only, even though the user has password configured too. #73

What are the Caddyfile directives that need to be added.

This feature adds several Caddyfile directives.

Via Transform User Directive

The following directive forces a particular authentication challenges via transform user directive.
Here, the user should authenticate with u2f (Yubico or passkey only). If this method is not configured
for the user, i.e. not tokens in user database, then it should fallback to totp (authenticator app passcode).
If authenticator app is not configured, then default to password only.

transform user {
  match origin local
  require auth challenges u2f
  require auth challenges password totp if u2f not available
  require auth challenges password if u2f and totp not available
}

Via Identity Store User Configuration

The same would apply when you add these requirements via user configuration
in the local identity store.

local identity store localdb {
  user jsmith {
    name John Smith
    email jsmith@localhost.localdomain
    auth challenges u2f
    auth challenges password totp if u2f not available
    auth challenges password if u2f and totp not available
  }
}

Via Profile API Endpoint

You should be able to configure the above with Profile API.