Last-used 2FA autoselect only considers one device per class

## What

last-used 2FA autoselect only considers one device per class, so WebAuthn is not re-selected when the user has multiple authenticators. Also: 2FA autoselect: #12942 wants to disable or policy-select the method because last-used autoselect (the #11978/#19580 bug) is wrong across desktop vs mobile.

## Want

- Last-used 2FA autoselect only considers one device per class, so WebAuthn is not re-selected when the user has multiple authenticators
- Related 2FA autoselect: #12942 wants to disable or policy-select the method because last-used autoselect (the #11978/#19580 bug) is wrong across desktop vs mobile

## Ideas this came from

- [#11978 autoselect last used 2fa device not working for webauthn](https://github.com/goauthentik/authentik/issues/11978) — When using WebAuthn for authentication it is not autoselected next time To Reproduce Steps to reproduce the behavior: 1. Make sure you have two types of 2fa dev
- [#12942 Disable autoselect 2FA method or choose based on policy](https://github.com/goauthentik/authentik/issues/12942) — Describe your question Since Authentik version 2024.10 the 2FA method to use is automatically selected based on which one was last used (https://github.com/goau
- [#19580 MFA device auto-select only takes on device per class into consideration](https://github.com/goauthentik/authentik/issues/19580) — For users with multiple devices of a given class, we only ever look at one of the devices for determining lastused since we only return one challenge per device

Start by tracing the 2FA last-used autoselect flow and the WebAuthn challenge selection described here, then compare it with issues #11978 and #19580. Reproduce the case with multiple authenticators in one class; done means last-used selection considers every device and reselects WebAuthn correctly.

Written by the indexing model from the issue text.