Allow users to force signinConfirmation on every login

[seanmonstar]

From KR:

Allow users to opt-in to using their email as a second
authentication factor. This is intended as a relatively cheap way to
judge potential uptake of a more elaborate 2FA feature later in the year.

Sticky links:

• WIP Feature Doc: https://docs.google.com/document/d/1JLPLSFuoui0loAWm761Fi2zr178eokUPuzG-F3Wy4-k/edit#

[rfk]

Thanks for filing this. Let's also start a feature-google-doc for planning out the work, I'll make an empty template one and link it in the issue description.