Login flow or framework for combining authentication factors (e.g. Duo)

We need a mechanism for combining at least 2 authentication factors (usually one being a password) to support use of technologies like Duo and U2F. This should be simple to configure, extensible to arbitrary factors, and handle step-up, SSO, ForceAuthn, etc.

Leaving open for now whether to try and extend this to more than two factors, but we have working code for two and that's by far the common case.