[GH-62] add a supported AuthnContextClass so the users with "fido" authenticaion at FredHutch can authenticate to our Service Provider (aka Relying Party)

[goulter]

Change Description: Some FHCC users are receiving this error upon 2fa:

https://teams.microsoft.com/l/message/19:b02654641e514c60a13851833efd626a@thread.tacv2/1785949564317?tenantId=f6b6dd5b-f02f-441a-99a0-162ac5060bd2&groupId=7b584b6a-8636-41cb-9ddf-7a896caeb827&parentMessageId=1785949564317&teamName=UWIT%20Incident%20and%20Service%20Desk%20Coordination&channelName=Identity%20and%20Access%20Management%20(IAM)&createdTime=1785949564317

Closes GH(s): GH-62

Entra ID SAML authnmethodsreferences (AMR) now supports phishing-resistant MFA
AuthnContextClassRef: urn:oasis:names:tc:SAML:2.0:ac:classes:SmartcardPKI

Single sign-on SAML (Security Assertion Markup Language) protocol - Microsoft identity platform

uw-saml-python Pull Request checklist

• I have run ./scripts/pre-push.sh
• I have selected a semver-guidance: label for this pull request (under labels,
  to the right of the screen)

If you do not do both of these things, your checks will either not run, or have a high probability of failing.

[jdiverp]

lets give this a try

[jprosser]

you may be able to fix this more permenately by just deleting the request for MFA and leaving it up to the FH IdP to decide here:

uw-saml-python/uw_saml2/idp/federated.py

Line 125 in 8b5c681

f"{_attribute_prefix2}/authnmethodsreferences": "saml_authncontextclassref",

[goulter]

@jprosser I'm not the expert for sure, but I like your suggestion. If we want FH to take ownership, like you suggest, we probably need to coordinate that kind of change with them. Then again, I might be a little green here 😅

[goulter]

I'll merge this in.