Add endpoint: verify-2fa

[whabanks]

Summary | Résumé

This PR adds a new endpoint for verifying 2fa auth codes without affecting a user's logged in state. This will be used to verify a users phone number when switching to the SMS 2FA method and the user has not already verified their phone number.

Additionally we're adding the verified_phonenumber property to the UserUpdateAttributeSchema schema, so we can mark their phone number as verified once they complete the code verification process.

Related Issues | Cartes liées

Test instructions | Instructions pour tester la modification

CI passes. We'll need the Admin PR to fully test this e2e.

Release Instructions | Instructions pour le déploiement

None.

Reviewer checklist | Liste de vérification du réviseur

• This PR does not break existing functionality.
• This PR does not violate GCNotify's privacy policies.
• This PR does not raise new security concerns. Refer to our GC Notify Risk Register document on our Google drive.
• This PR does not significantly alter performance.
• Additional required documentation resulting of these changes is covered (such as the README, setup instructions, a related ADR or the technical documentation).

⚠ If boxes cannot be checked off before merging the PR, they should be moved to the "Release Instructions" section with appropriate steps required to verify before release. For example, changes to celery code may require tests on staging to verify that performance has not been affected.