[1.x] Only use two factor action when enabled

[stevebauman]

Purpose

This PR resolves the issue of validating credentials twice when two-factor is disabled and the default login pipeline is used:

fortify/src/Http/Controllers/AuthenticatedSessionController.php

Lines 83 to 88 in c77b183

	return (new Pipeline(app()))->send($request)->through(array_filter([
	config('fortify.limiters.login') ? null : EnsureLoginIsNotThrottled::class,
	RedirectIfTwoFactorAuthenticatable::class,
	AttemptToAuthenticate::class,
	PrepareAuthenticatedSession::class,
	]));

Description

When two-factor authentication is disabled via the configuration file, users credentials are still validated twice, even though the action can be bypassed completely and another database call / $authenticateUsing callback execution can be avoided.

This is due to the RedirectIfTwoFactorAuthenticatable action, as well as the AttemptToAuthenticate action.

This was brought to light when overriding the $authenticateUsing callback, since it will be called twice, even when two-factor is omitted in features.

[stevebauman]

Thank you! ❤️