[v14] Stop users from deleting their last passwordless device

[codingllama]

Backport #35794 to branch/v14.

Stop users from deleting their last passwordless device in a passwordless-capable cluster.

In certain situations, like clusters with "second_factor:optional", it's possible to delete all your MFA devices. A pure passwordless user could lock themselves out by doing so.

This PR makes it impossible to delete your last passwordless device (if the cluster allows passwordless logins), preventing those lockouts at the cost of being more restrictive for "normal" users.

#32690

Changelog: Stop users from deleting their last passwordless device

[codingllama]

Production code ported cleanly, but tests are missing various refactors I did when deprecating MFA streams - see #20343 (comment). There are a few tweaks on things like client names (no authClient or userClient variables) and the addition of "initReqs" (not used anymore on master).

I also found out that the WithPasswordless() test option wasn't working, so fixed that one too.