Add opt-in credential confirmation for MapIdentityApi 2FA management operations

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Is your feature request related to a problem? Please describe the problem.

`MapIdentityApi` maps `POST /manage/2fa`. Enabling 2FA requires a valid `TwoFactorCode`, while the following operations require only the current authenticated principal:

- Disabling 2FA (`Enable: false`)
- Resetting the authenticator key (`ResetSharedKey: true`)
- Regenerating recovery codes (`ResetRecoveryCodes: true`)

Applications that want users to confirm their current password or provide a valid 2FA code before these operations must currently replace or copy the framework endpoint. There is no supported configuration or extension point for adding this confirmation.

### Describe the solution you'd like

Provide an opt-in mechanism for requiring credential confirmation before selected `POST /manage/2fa` operations.

The exact API could use options, a policy, or an application-provided validation service. It should allow applications to:

- Select which operations require confirmation.
- Accept confirmation using the current password and/or a valid 2FA code.
- Return the existing validation-problem response shape when confirmation fails.
- Preserve the current behavior by default for compatibility.

### Additional context

This behavior is present in ASP.NET Core 10.0.10 and the current implementation.

Related issues #50303 and #55529 discuss broader Identity API endpoint extensibility, but do not appear to cover operation-specific credential confirmation.

Start with the current MapIdentityApi implementation for POST /manage/2fa and review how enabling, disabling, authenticator-key reset, and recovery-code regeneration are validated. Compare related issues #50303 and #55529 for extensibility context. Done means an agreed opt-in design supports selecting operations and password or 2FA confirmation while preserving default behavior and the existing validation-problem response shape.

Written by the indexing model from the issue text.