Enforce 2FA for super admins

[iandunn]

See #6

This adds a few roles to get started. If this looks good, we can add more in a future PR.

This will require a small change to capes.php:

-	$super_admins =& $supes;
+	// This is a copy rather than a reference so that `$supes` can represent folks who _might_ have elevated
+	// privileges, and `$super_admins` can represent folks who _do_ currently have them.
+	// `wporg-two-factor` needs that distinction to disable capabilities until 2FA is setup.
+	$super_admins = array_merge( $supes );

[dd32]

LGTM, I've added some comments on my thoughts of implementation, but I think this is good to go regardless of those.

[dd32]

Another option here I think is to return the do_not_allow cap when the requested cap is anything other than the whitelisted caps.

I believe that would override the super-admin always-truthful caps too, but remove_super_admins_until_2fa_enabled() would be best kept still then too.

[iandunn]

Ah, that's a good point 👍🏻

[iandunn]

Er, nevermind, it looks like user_has_cap doesn't even get called in that case.

https://github.com/WordPress/wordpress-develop/blob/a71d7373ad6ce0a8f252717832f42aebc3e08854/src/wp-includes/class-wp-user.php#L780-L809

[iandunn]

I'll wait until Monday to deploy the capes.php change, and a few related ones I noticed since then. I'll go ahead and merge this now though, since I think it's ready.