AppAPI: allow to bypass Two-Factor

[bigcat88]

• Resolves: AppAPI with TwoFactor Auth enabled

Summary

AppAPI must support passing two-factor authentication so that ExApps can work in such systems.
By design they should do so.

Original issue where it was discovered(we just completely forgot about two-factor auth):
cloud-py-api/app_api#181

Since the context_chat was already released we should provide a fix for this situation.
Also the backport to stable28 branch is required, as this is a bug that blocks all Apps developed for AppAPI to work in most production systems.
If possible, also a backport to stable27 branch will be nice.

Ref:

• Previous PR allowing CORS skip for AppAPI: added CORS skip if session was created by AppAPI #40737
• Rename AppEcosystem to AppAPI: Rename AppEcosystemV2 to AppAPI #40295
• Initial PR with AppEcosystem auth: AppEcosystem Authentification #39655

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)

[ChristophWurst]

Looks good but didn't test

Please squash your commits into one

[juliushaertl]

CI failure seems related, please fix and squash in this PR

Time: 00:26.907, Memory: 193.03 MB

There was 1 failure:

1) Test\Authentication\TwoFactorAuth\ManagerTest::testNeedsSecondFactorSessionAuth
Expectation failed for method name is "get" when invoked 1 time(s)
Parameter 0 for invocation OCP\ISession::get('app_api') does not match expected value.
Failed asserting that two strings are equal.
--- Expected
+++ Actual
@@ @@
-'two_factor_auth_passed'
+'app_api'

/drone/src/lib/private/Authentication/TwoFactorAuth/Manager.php:322
/drone/src/tests/lib/Authentication/TwoFactorAuth/ManagerTest.php:640

--

[bigcat88]

/backport to stable28

[bigcat88]

/backport to stable27