AMR MFA field not being sent to OIDC client?

**Describe your question/**
I've set up Cloudflare Access to require MFA for a site. Authentik users who have MFA set up get rejected by Cloudflare saying they don't have access.

I don't think amr is being sent to Cloudflare.

**Relevant info**
When I look at the Authentik provider data preview, I see the following:

```json
{
"...": "..."
"acr": "goauthentik.io/providers/oauth2/default",
"amr": [
"pwd",
"mfa"
],
"...": "..."
}
```

Looking at log event where the user should have been approved:

```json
{
"flow": "33ee351722714c3c9d5b117a357d3cb8",
"...": "..."
"scopes": "email openid profile",
"http_request": {
"args": {
"scope": "openid email profile",
"state": "...",
"...": "..."
},
"path": "/api/v3/flows/executor/default-provider-authorization-explicit-consent/",
"method": "GET",
"user_agent": "..."
},
"authorized_application": {
"pk": "...",
"app": "authentik_core",
"name": "cf-app",
"model_name": "application"
}
}

User
{
"pk": "...",
"email": "...",
"username": "..."
}
```

The application model has the same User object:

```json
User
{
"pk": "...",
"email": "...",
"username": "..."
}
```

I assume the User objects should contain `"amr": ["mfa"]`?

**Screenshots**
Cloudflare MFA settings:

Authentik user MFA:

**Logs**
N/A

**Version and Deployment (please complete the following information):**

- authentik version: 2024.6.0
- Deployment: docker-compose

**Additional context**
The Cloudflare / Authentik connection works perfectly fine when MFA isn't required.

The report names no repository files or tests. Start by reproducing the Cloudflare Access flow and tracing the OAuth authorization path at /api/v3/flows/executor/default-provider-authorization-explicit-consent/, comparing the provider data preview with the claims received by the OIDC client. Done means confirming whether amr is emitted and identifying the point where it is lost, if applicable.

Written by the indexing model from the issue text.