fix: Use NoTwoFactorRequired annotation instead of attribute

Co-authored-by: Carl Schwan <carl@carlschwan.eu>
Signed-off-by: Carl Schwan <carl@carlschwan.eu>

Author: CarlSchwan

core/Controller/AppPasswordController.php

@@ -201,11 +201,11 @@ public function confirmUserPassword(string $password): DataResponse {
 	 *
 	 * @return DataResponse<Http::STATUS_OK, array{apppassword: string}, array{}>
 	 * @throws OCSForbiddenException Creating app password is not allowed
+	 * @NoTwoFactorRequired
 	 *
 	 * 200: App password returned
 	 */
 	#[NoAdminRequired]
-	#[NoTwoFactorRequired]
 	#[ApiRoute(verb: 'GET', url: '/getapppassword-onetime', root: '/core')]
 	public function getAppPasswordWithOneTimePassword(): DataResponse {
 		// Only allow with one-time app passwords