Require password reset for 2FA enrollment after requirement is enforced.

[ewdurbin]

What's the problem this feature will solve?

Once we have required 2FA for uploads globally, we should require a password reset flow to be completed before allowing enrollment of a 2FA mechanism.

This keeps "abandoned" accounts from being hijacked by a simple password leak, with the caveat that a compromised email is a compromised email.

Describe the solution you'd like

After global 2FA requirement for upload is enforced, a user returning to enroll in 2FA should be required to complete a password reset flow. We can gate this on the "last password date" value for a given user.

[di]

Do we actually need to reset the password, or can we just do an email verification flow?

[ewdurbin]

I think #15692 closes this.