fix: ignore mfaEnforced when user has no MFA tokens

Pavel Břoušekrequested to merge
ignoreMfaEnforcedWithoutMFA into main

Created by: melanger

prevent lock-outs when user removes or revokes all tokens

BREAKING CHANGE: mfaEnforced is ignored for users without MFA tokens

Merge request reports