[Security] Org-wide 2FA requirement; Allow managers to enforce 2FA for all team members

For example, on GitHub, you can have an organization enforce that all its members have 2FA enabled. We want the same for HCB organizations.

This would be in the org's settings and configurable by managers. To disable org-wide 2FA, you must be in Sudo mode.

We will also need to build a grace period for when 2FA is required, but users haven't configured it yet. After the grace period, the next time you sign in (and don't have 2FA configured), you'll be forced to configure it then and there.

Start by tracing the organization settings, manager permissions, Sudo mode, and sign-in flows involved in 2FA. Define how the organization-wide requirement and grace period should interact with users who lack 2FA, including when setup becomes mandatory. Done means managers can configure the requirement, disabling it is restricted appropriately, and affected users are prompted after the grace period.

Written by the indexing model from the issue text.