feat: support MFA via SMS

[jonas-jonas]

Related issue(s)

Checklist

• I have read the contributing guidelines.
• I have referenced an issue containing the design document if my change
  introduces a new feature.
• I am following the
  contributing code guidelines.
• I have read the security policy.
• I confirm that this pull request does not address a security
  vulnerability. If this pull request addresses a security vulnerability, I
  confirm that I got the approval (please contact
  [email protected]) from the maintainers to push
  the changes.
• I have added tests that prove my fix is effective or that my feature
  works.
• I have added or changed the documentation.

Further Comments

[codecov]

Codecov Report

Attention: 41 lines in your changes are missing coverage. Please review.

Comparison is base (f1493c8) 78.31% compared to head (1e9e44e) 78.27%.

Files	Patch %	Lines
selfservice/strategy/code/strategy.go	84.50%	17 Missing and 5 partials ⚠️
selfservice/strategy/code/code_sender.go	58.82%	6 Missing and 1 partial ⚠️
courier/sms_templates.go	0.00%	5 Missing ⚠️
courier/template/sms/login_code_valid.go	77.77%	4 Missing ⚠️
cmd/clidoc/main.go	60.00%	2 Missing ⚠️
selfservice/strategy/code/strategy_login.go	97.43%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3682      +/-   ##
==========================================
- Coverage   78.31%   78.27%   -0.05%     
==========================================
  Files         347      347              
  Lines       23763    23769       +6     
==========================================
- Hits        18611    18605       -6     
- Misses       3749     3759      +10     
- Partials     1403     1405       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[hperl]

This looks very good! I just had a question regarding the enable logic for the strategies. What I'd like to prevent is cases where with a new update suddenly some strategy is disabled that was previously enabled. The rest looks good!

[alnr]

Found just two nits, otherwise this looks OK to me.

[hperl]

LGTM!

[aeneasr]

Looks pretty good! A few more questions from my side

[aeneasr]

Thinking over this, the code method should be explicitly enabled for MFA / first factor and not implicitly support both!

[hperl]

LGTM with small comments.