Enable detecting which TOTP was used for MFA

[lauri865]

Currently, there doesn't seem to be a way to detect which factor was used to verify MFA challenge for the session. Only way seems to be by querying the challenges table, but that's not tied to a session.

Use case would be to show in factors list which factor is currently in use, so that users don't accidentally delete the factor they are actively using. Alternatively or additionally, a last_used_at column could be useful as well to showcase stale factors that can be safely removed.

[lauri865]

Would also be easier to prompt the currently used TOTP for re-verification of more critical actions, such as adding a new TOTP factor.