Add SSO MFA docs

[Joerger]

Add documentation for the new SSO MFA feature. See the RFD for more details.

[github-actions]

🤖 Vercel preview here: https://docs-mzyc3e21c-goteleport.vercel.app/docs

[github-actions]

Amplify deployment status

Branch	Commit	Job ID	Status	Preview	Updated (UTC)
joerger/sso-mfa-docs	055b7e2	4	✅SUCCEED	joerger-sso-mfa-docs	2025-01-03 21:29:04

[ptgott]

I still need to give this a proper review, but there are some internal links we need to fix for the preview build to work:

content/current/docs/pages/admin-guides/access-controls/sso/sso.mdx
    422:3-422:43  warning  Link to unknown file: `per-session-mfa.mdx`        missing-file  remark-validate-links
    423:3-423:4[9](https://github.com/gravitational/teleport/actions/runs/12586952343/job/35081837336#step:8:10)  warning  Link to unknown file: `moderated-sessions.mdx`     missing-file  remark-validate-links
    424:3-424:47  warning  Link to unknown file: `mfa-for-admin-actions.mdx`  missing-file  remark-validate-links
  437:66-437:[10](https://github.com/gravitational/teleport/actions/runs/12586952343/job/35081837336#step:8:11)6  warning  Link to unknown file: `per-session-mfa.mdx`        missing-file  remark-validate-links

[ptgott]

The partial doesn't render here—do we need to remove the leading slash?

[Joerger]

This also appears to be the case for existing sections in the preview, but those sections do load in the actual docs site.

[Joerger]

Friendly ping to review @nklaassen @kiosion @mmcallister

[nklaassen]

the example yaml's seem to suggest the user should create a separate app in the IDP for doing MFA, should we be more explicit about suggesting that in this section? It feels like we're not really telling people what they need to do here

[Joerger]

This is intentionally left vague and meant as an exercise for the reader to set up their own specific solution. You could set up a separate app or use the same app depending on the IDP offerings.

You're right it is too vague though, I will leave a couple examples and more guidance. My only concern is that I haven't actually been able to test these approaches with MFA enabled, since we don't have access to an enterprise Okta or Auth0 account for testing. In my testing I've most used a custom Auth0 Action which displays a fake webauthn prompt (no-op button) in place of an actual MFA prompt.