R1:535cfa3ebebe

Add `bin/auth list-factors` and `bin/auth strip` to remove multi-factor auth

Summary:
Ref T4398. The major goals here is to let administrators strip auth factors in two cases:

- A user lost their phone and needs access restored to their account; or
- an install previously used an API-based factor like SMS, but want to stop supporting it (this isn't possible today).

Test Plan:
- Used `bin/auth list-factors` to show installed factors.
- Used `bin/auth strip` with various mixtures of flags to…