Don't use unavailable identity verification methods when adding MFAs

[bl-nero]

This change restricts the available identity verification methods to the ones that are configured in the user's account. It also provides error messaging for when no such method is available.

Note that the latter is an edge case that occurs only when the cluster configuration has been changed while the user was signed in, but nevertheless, it's possible.

Closes #23443

Tested:

• Adding a passkey, having only a WebAuthn key
• Adding a passkey, having only an authenticator app
• Adding a WebAuthn key, having only a WebAuthn key
• Adding a WebAuthn key, having only an authenticator app
• Adding a WebAuthn key, having both methods available
• Adding an authenticator app, having only a WebAuthn key
• Adding an authenticator app, having only an authenticator app
• Adding a WebAuthn key, having no eligible MFA method (OTP required)
• Adding a WebAuthn key, having no eligible MFA method (WebAuthn required)

[public-teleport-github-review-bot]

@bl-nero See the table below for backport results.

Branch	Result
branch/v15	Failed