R1:46052878b1de

Bind MFA challenges to particular workflows, like signing a specific Legalpad document

Summary:
Depends on D19888. Ref T13222. When we issue an MFA challenge, prevent the user from responding to it in the context of a different workflow: if you ask for MFA to do something minor (award a token) you can't use the same challenge to do something more serious (launch nukes).

This defuses highly-hypothetical attacks where the attacker:

- already controls the user's session (since the challenge is already…