Disable MFA without TOTP

New Issue Checklist

• Report security issues confidentially.
• Any contribution is under this license.
• Before posting search existing issues.

Issue Description

Originally posted by @SteffenKeller:

A logged-in user can disable MFA for their account without entering a valid verification code by simply calling the unlink function or saving null for the MFA auth data.

The TOTP auth adapter prevents setting a new secret without a valid code (AuthenticationAdapters.spec.js line 2413), but it does not prevent clearing the secret first and then setting a new one.

This may not be critical, but since the TOTP auth adapter was designed to require a valid code to disable mfa, I thought it was worth mentioning.

Steps to reproduce

JS SDK:

await user._unlinkFrom('mfa');

or

await user.save(
    { authData: { mfa: null } },
    { sessionToken: user.getSessionToken() }
);

Environment

Server

• Parse Server version: FILL_THIS_OUT

Start with the TOTP auth adapter and AuthenticationAdapters.spec.js around line 2413, then trace the unlink and authData-clearing paths described in the reproduction. Add regression coverage showing that disabling MFA without a valid verification code is rejected, and run the relevant authentication adapter tests to confirm both unlinking and saving null remain protected.