Auth system improvements

### Code of Conduct

- [x] I agree to follow Django's Code of Conduct

### Feature Description

(This is a split from https://github.com/django/new-features/issues/10)

### Problem

Django has a builtin authentication system, but it doesn't cover features that should be present in any authentication system (e.g. 2FA), [as per NIST suggestions](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63-3.pdf). It is fine for local testing and production services categorised at AAL1 level, but anything above that requires 3rd party packages (`django-allauth` comes to mind as an example of a very robust and feature rich package).

I understand that Django can't just merge `django-allauth` and call it a day. A framework has a radically different release schedule compared to a 3rd party package, and supporting oauth with XYZ service (which would require hardcoding URLs of external services) feels like a stretch, but maybe there could be a middle ground. Maybe Django can integrate into its core some parts of `django-allauth`?

### Request or proposal

Request changes for Django to implement / provide out of the box:

* at least basic password-related functionality (user registration, password recovery, etc...)
* secure authentication mechanisms (2FA / MFA; maybe hardware authentication, eg. yubikeys)
* stateless authentication (jwt creation, refresh, invalidation, etc...)

I would suggest trying to integrate the core (features) of `django-allauth`.

### Additional Details

_No response_

### Implementation Suggestions

_No response_

Start by reading the split proposal at new-features#10 and comparing Django’s built-in authentication scope with django-allauth. The issue names no files, tests, or entry points; work is not well-defined until the broad request is narrowed to a specific capability and completion criteria.

Written by the indexing model from the issue text.