Allow adding validation policies into the MFA account configuration

**Is your feature request related to a problem? Please describe.**
Currently, it is possible for users to remove all MFA devices in spite of the organization policy requiring MFA for login.

**Describe the solution you'd like**
Make it possible to add validation policies to the MFA device configuration, such as “You must have at least 1 WebAuthn device enrolled”.

**Describe alternatives you've considered**
The current approach is to force users who don’t already have an MFA device enrolled to set up a new one during the MFA validation stage. However, this is still a reduction in security compared to not allowing their account to get into this state in the first place.