[Task]: Re-prompt for MFA for sensitive actions

[diox]

Description

To improve security we want to re-prompt for the user second factor authentication mechanism on their Mozilla Account when they perform sensitive actions.

FxA is adding support for this on their side in:

• https://github.com/mozilla/fxa/pull/20977  (FXA-14308)
• feat(oauth): add acr and auth_time to JWT access token and introspect fxa#20980 (FXA-14309 + FXA-14310)
• feat(settings): support step-up auth in sign-in flow fxa#20992 (FXA-12856 + FXA-12861)

Once this lands the rough implementation idea would be:

• When authenticating on AMO side, look at the auth_at in FxA's JWT claim or use their introspect API to figure it out
• Redirect sensitive endpoints to go through FxA authorization endpoint with acr_values=AAL2 and max_age=X to request a recent 2FA - 0 being an acceptable value.
• (redirect back on successful auth - should happen normally)

In this ticket we should:

• Figure out what are sensitive actions
• Figure out what's an acceptable "max age" - time since the last 2FA from the user
• Implement that reprompt as highlighted above, behind a waffle switch or flag.

Acceptance Criteria

• item 1

┆Issue is synchronized with this Jira Task