Rethink capability name /mfa-capable

[michielbdejong]

We can change the string /mfa-capable to something without a leading slash.
Also, the 'capable' is already implied by the fact that this string appears in a list of capabilities
And maybe we want to add what the server is capable of doing. It's not only capable of MFA, we want it to be able to securely and reliably enforce an MFA requirement on a share.
So maybe something like 'mfa-requirement' or 'enforce-mfa-requirements'?

[glpatcern]

I think the bigger picture is well summarized in #121