As a ItSec engineer, I need possibility to configure app authorisation based on authentication stage data.

### Is your feature request related to a problem?

Our Authnetik setup allows two 2FA methods allowed: TOTP and WebAuthn. For organisational reasons, we can't refuse of TOTP, but our ItSec team wants to allow access for some sensitive services only for sessions that were initiated with WebAuthn method.
Currently it's impossible because Authentik authentication and an application authorization are two different flows, that are launched at different times.

### Describe the solution you'd like

We would like to Expression Policy had possibility to create and read custom data for user session. Similar to [managing flow context keys](https://next.goauthentik.io/customize/policies/types/expression/managing_flow_context_keys/), but this data would be stored at session object and available during the whole session lifetime (or until this data is removed/modified, if such functionality is implemented too).
Thus, our global flow would look like this:
1. A user sings-in to Authentik. Our custom expression policy in the scope of an authentication flow adds authentication method used by the user to the user session.
2. Custom expression policy in the scope of authorization flow for a 'very sensitive service', reads and validates authentication methods from user session.

### Describe alternatives that you've considered

Alternatives that we consider:
1. Restrict TOTP method. Since 2FA is globally required, users will be forced to use WebAuthn. But WebAuthn is less reliable, it depends on browser version, browser system permissions, OS kind and version, and other various criteria. Our users have various devices with different OS and app versions, we can't enforce all of them to use only WebAuthn.
2. Migrate all clients to MDM devices, but this is another long story.

### Additional context

_No response_