fix: correct rollout_state handling

ignore only some rollout states

lib/Auth/Process/GetMfaTokensPrivacyIDEA.php

@@ -167,7 +167,10 @@ class GetMfaTokensPrivacyIDEA extends \SimpleSAML\Auth\ProcessingFilter
         $types = [];
         foreach ($tokens as $token) {
             foreach ($this->tokens_type as $type) {
-                if ($token['tokentype'] === strtolower($type) && empty($token['rollout_state'])) {
+                if (
+                    $token['tokentype'] === strtolower($type)
+                    && !in_array($token['rollout_state'] ?? '', ['clientwait', 'verify'])
+                ) {
                     $token[$this->token_type_attr] = $type;
                     $types[] = $token;
                     break;