Allow deleting last passkey in certain circumstances

[bl-nero]

This PR allows deleting the last passkey if the following conditions are true:

• The user is known to have a password set.
• The user has at least 1 additional MFA method, and this method can be used to log in on this cluster.

Changelog: Allowed deleting user's last passkey if they have a password and another MFA set up.

Closes #38433

Tested manually:

• Attempt to delete with password enabled, no other MFA
• Attempt to delete with other MFA, but no password
• Attempt to delete with other MFA, unknown password state
• Delete with password and YubiKey
• Delete with password and OTP

[codingllama]

Thanks!

We couldn't do better at the time, but we certainly can now. I got a couple of complaints over this one, so it's definitely good to see it relaxed.

Could you add the appropriate backport labels, please?

[codingllama]

Suggested change

	func TestDeletingLastPasswordlessDevice(t *testing.T) {
	func TestDeletingLastPasswordlessDevice(t *testing.T) {
	t.Parallel()

[bl-nero]

Could you add the appropriate backport labels, please?

Added v15; that's as early as we can go here, since it depends on #40911.

[codingllama]

Could you add the appropriate backport labels, please?

Added v15; that's as early as we can go here, since it depends on #40911.

Sounds good, thanks!

[bl-nero]

Retested, will merge once tests pass

[public-teleport-github-review-bot]

@bl-nero See the table below for backport results.

Branch	Result
branch/v15	Create PR