Reconcile MFA mechanisms

[jmhale]

Since the support for per-app MFA was included, two separate mechanisms for handling MFA has begun to emerge. They're doing very similar things, but in different ways.

I refactored the Okta auth code to pull each of these out into their own classes in order to help reason about what each of them are doing, but the ultimate goal should be to combine these into one of the existing or a new class and use that for both login flows.

Currently, we have support for different factors depending on if the user is authenticating to the base org or an app. Okta doesn't differentiate between the two on what factors are allowed, so neither should we.