Expand --mfa-mode and disable stdin hijack by default

[codingllama]

Avoid "input swallowing" bugs by disabling stdin hijacking by default.

Only tsh login is allowed to hijack stdin, as it is expected to exit right after authentication. Any MFA authentication attempts resulting from non-tsh login invocations default to the user's strongest auth method.

Defaulting to the strongest auth method can cause problems in constrained environments for users that have both Webauthn and OTP registered. For example, someone using tsh under WSL (Windows Subsystem for Linux) or a remote machine could be locked into Webauthn MFA, which they can't use because their environment lacks USB access or they don't have physical access to it. In order to solve this problem I've slightly modified the meaning of the --mfa-mode flag so otp can be specified.

The TELEPORT_MFA_MODE environment variable may be set to avoid constant flag passing.

Fixes #12675 and #13021.

[zmb3]

Code changes look good - see below for a few comments.

Are there any docs that we should update along with this change?

[Tener]

Looks good overall.

Would it make sense to make it possible to put the preferred modes into tsh config file?

teleport/tool/tsh/tshconfig.go

Lines 39 to 44 in 6f51c36

	// TshConfig represents configuration loaded from the tsh config file.
	type TshConfig struct {
	// ExtraHeaders are additional http headers to be included in
	// webclient requests.
	ExtraHeaders []ExtraProxyHeaders `yaml:"add_headers,omitempty"`
	}

[codingllama]

@zmb3 I'll follow up with docs separately - both for tsh and passwordless (which I still need to write).

@Tener I'll have a look at the config file and possibly follow up in a separate PR, although I think the env var might be good enough for remote machines. Let's see.

[codingllama]

Thanks for the reviews, everyone.