Force 2FA on every user

[OpenNebulaSupport]

Description
2FA is currently configured on a per user basis. The configuration is stored on the user template. If an admin tries to set the 2FA, a user could remove it by issuing a one.user.update call since the configuration resides on the user template. To prevent this, the 2FA config, could be set as restricted attr for users

USER_RESTRICTED_ATTR = "SUNSTONE/TWO_FACTOR_AUTH_SECRET"
USER_RESTRICTED_ATTR = "FIREEDGE/TWO_FACTOR_AUTH_SECRET"

however, this also prevents the user from setting 2FA on their own initially. Ideally, 2FA could be set on a global scale by the cloud admin as an auth policy.

Use case
To prevent users from disabling 2FA but also allowing them to enable it.

Progress Status

• Code committed
• Testing - QA
• Documentation (Release notes - resolved issues, compatibility, known issues)