Limit available providers

[iandunn]

We should choose which providers we want to enable, and disable all of the others.

We'll probably want accounts with greater access to have more strict requirements. e.g., Core committers should use webauthn as primary and TOTP as backup, while regular users can can use TOTP as primary and (maybe) email as backup.

[iandunn]

For this I'm assuming that both WordPress/two-factor#439 and WordPress/two-factor#427 have landed, so the options are: Webauthn, TOTP, Email, Backup Codes, Dummy.

We should disable the Dummy provider of course. I think we should disable Email too. In some cases it's better than nothing, but we'd only want it available for regular users (who probably don't really need 2FA anyway). It's simpler to just disable it than trying to enable it conditionally based on someone's role. It'll simplify support as well. I've never seen a site offer email as a second factor.