fix(whitelist): Recognise every two-factor provider app for guests

[solracsf]

Fix #1628

WHITELIST_ALWAYS hardcoded four twofactor apps, so a guest hitting any other provider got a 403 and could not finish the setup or the challenge. On an instance with enforced two-factor authentication that locks the guest out until an admin figures out that the provider app has to be whitelisted by hand.

Instead of growing that list by hand, an app that declares two-factor-providers in its info.xml is now allowed at runtime. That covers twofactor_admin, twofactor_email, twofactor_oath, twofactor_u2f and twofactor_webeid, plus any provider app that ships later.

Providers can also be registered from the app bootstrap, and that list is only reachable through private API, so those apps still have to be named. twofactor_gateway is added for that reason. The four that were already listed stay listed too: the runtime lookup only helps while info.xml is readable and while the app keeps declaring its provider there, and losing either would lock guests out again, which is the bug this fixes.

The lookup is gated on the app being enabled. That matches what ProviderLoader does, and it also keeps guessed app ids from resolving an app path on disk on every request.

[CarlSchwan]

Suggested change

	/**
	* Two-factor authentication has to keep working for guests, otherwise an
	* instance with enforced two-factor authentication locks them out. So an
	* app that declares a two-factor provider is allowed even when the
	* administrator did not whitelist it.
	*
	* ProviderLoader also picks up providers that apps register from their
	* bootstrap, but that list is only reachable through private API, so those
	* apps are named in WHITELIST_ALWAYS instead.
	*/
	private function isTwoFactorProviderApp(string $appId): bool {
	// Also keeps unknown app ids away from the info.xml lookup below,
	// which would resolve the app path on disk for every guess.
	private function isTwoFactorProviderApp(string $appId): bool {

we don't need this gigantic comments

[solracsf]

Sorry, I've learned that good and extensive doc is as good as good code. I'll remove it. 😊