Allow drive-by contributors to login using Github-without-2FA

In https://github.com/mozilla-iam/auth0-deploy/pull/145 we forced 2FA on people using Github as their authentication provider.

The recent Discourse thread https://discourse.mozilla.org/t/github-login-issue/23730 shows that this locks out people from participating in Discourse conversations who are not holding any Mozilla IAM Access Groups (because they do not even have a Mozillians.org profile). For sake of simplicity, let's call this group drive-by contributors.

As Github signals whether or not 2FA is being used, we could change towards the following business rules:

Hierachy for Most Secure Login:

Mozilla LDAP+MFA > Github+2FA > Github|Google > Passwordless Email

Access Groups would only be relayed for MFA/2FA login methods (i.e. LDAP and Github+2FA).

Conclusion:
Such a change would allow drive-by contributors to use Github as authentication provider and have a username+password login method on Mozilla sites such as Discourse.

Start by reviewing pull request 145 and the linked Discourse thread to understand the existing 2FA enforcement and the drive-by contributor case. Trace the Auth0 rules and hosted pages involved, then verify that GitHub users without 2FA can log in while Access Groups remain limited to LDAP and GitHub+2FA methods.