Add and use constants for session flashes

[dwightwatson]

This addresses what I brought up in #408 that it's a little awkward having to compare the status flash to hard-coded strings like two-factor-authentication-enabled to appropriately show the correct messaging to the user. This provides constants on Laravel\Fortify\Fortify which provides clarity in end-user code that the expectation is that these flash messages are a result of an interaction with Fortify.

I've intentionally adopted similar naming to that used by the constants in Laravel's PasswordBroker.