[User] Prevent `use_two_factor_authentication` when only 1 factor is available

[garyhtou]

In this helpscout ticket, admins updated someone's phone number, which had put it into an unverified state.

However, since this user had 2FA enabled, it locked them out of their account because there was no second factor available for authentication.