Clean up obsolete TOTP secrets

[baszoetekouw]

We have quite a lot of users who used to need TOTP-MFA, but who have long ago moved to institutional MFA. Those users still have TOTP secrets in de db.

These should be invalidated. So, if we detect a user (during proxy_authz or SBS login) who is logging in though a allow-listed MFA IdP, and who still has a TOTP-secret in the database, we should remove their TOTP secret.