[3.0] Lets something other than a password log a member in

[albertlast]

Description

Groundwork so that something other than the password form can log a member in. No new
feature here, and nothing user visible on a stock install — this is the part that OpenID
Connect and passkeys would both otherwise have to work around, split out so it can be
reviewed on its own.

Three things currently assume the password form:

1. The steps after a successful check are unreachable. Login2::DoLogin() calls
   integrate_login, sets the cookie, resets the flood counter, enforces bans, writes
   member_logins and redirects — but it is protected and reads $this->member, so
   anything else authenticating a member has to reimplement it and will quietly miss a
   step. Moved to Login2::completeLogin($member, $stay_logged_in, $redirect);
   DoLogin() is now a one line caller, so the password path is byte for byte the same.
2. Two factor authentication is tfa_secret. Every place that asks "does this member
   have a second factor" reads that column. Added User::getSecondFactors(), which
   reports what they have and lets a mod register its own via integrate_second_factors.
   It reads the loaded profile rather than object properties, because verifyTfa() runs
   before setProperties() has populated anything.
3. Every account is assumed to have a password. Added
   User::hasUsablePassword(). The login form now refuses such an account before
   checkPasswordFallbacks() compares the submitted password against an empty hash, and
   validateSession() offers integrate_reauthenticate so a member who signs in some
   other way is not simply locked out of the admin and moderation areas. Nothing in SMF
   creates such an account yet; this is the seam for whatever does.

Also adds a member_auth table for the credentials such accounts would sign in with
(deleted along with the member), and a slot on the login form that renders whatever
registers through integrate_authentication_methods.

One behaviour change worth flagging. Login2::checkCookie() now checks tfa_mode as
well as the member, which User::verifyTfa() already did. Previously a member with a
tfa_secret on a forum with TFA switched off was redirected to ?action=logintfa, where
nothing was going to ask them for a code — they got "You are not allowed to access this
section" instead of being logged in. They now log in normally. This is not a weakening:
with tfa_mode off, verifyTfa() was not enforcing anything either way.

New hooks: integrate_second_factors, integrate_authentication_methods,
integrate_reauthenticate. Each is documented at its call site, since there is no central
hook list to add them to.

Testing. A 14 check regression run over the login paths this touches — form renders,
correct and incorrect password, remember me and its cookie lifetime, logout, the admin
password re-prompt and passing it, a member with TOTP being held at the second factor, and
an account with an empty passwd being refused — passes identically on this branch and on
unmodified release-3.0, which is the point for a change that is meant to alter nothing.
Run on both MySQL and PostgreSQL. The new table was checked on both engines, created by
the installer on a fresh install (73 tables) and by the migration on an existing one. The
two new extension points were exercised with a throwaway mod: a registered method renders
on the login form, and a registered factor holds back a member who has no tfa_secret at
all.

Noted while testing, not touched here: ?action=logintfa is already broken on
release-3.0 independently of this. LoginTFA::execute() does
User::load(..., dataset: User::$me->dataset), but verifyTfa() has just reset the member
to a guest, whose dataset is null, so it dies with "Cannot assign null to property
SMF\User::$dataset". Reproduced identically with and without this branch. Worth its own PR.

Issues References (Fixes|Related|Closes)

1. Groundwork for OpenID Connect and passkey support

[albertlast]

@Sesquipedalian you mention you would like to see passkeys to work this would be the base of this idea,
some addiotnal pr will be in the pipeline