Feature Request: Configurable MFA Scope for Elevated Permissions Only

### What feature do you want to see added?

### Is your feature request related to a problem?
Currently, MFA enforcement applies broadly, which can create extra friction for users who do not perform administrative or security-sensitive actions.

### Describe the solution you'd like
Add a global configuration option to require MFA only for users who have any of the following Jenkins permissions:

- `Administer`
- `Manage`
- `SystemRead`

When enabled, users without these permissions should not be prompted/enforced for MFA.

### Additional context
In Jenkins, enumerable administrative permissions are easily identifiable, making it simple to apply more security rules on administrators. Also, for internal Jenkins services in isolated network environments, it reduces the need for ordinary users to perform additional operations. This would allow organizations to balance security and usability by focusing MFA on elevated-access users while reducing login friction for standard users.

### Upstream changes

_No response_

### Are you interested in contributing this feature?

_No response_