SQSERVICES-1375-block-bot-api-if-2-fa-is-enabled

[battermann]

https://wearezeta.atlassian.net/browse/SQSERVICES-1375

Checklist

• The PR Title explains the impact of the change.
• The PR description provides context as to why the change should occur and what the code contributes to that effect. This could also be a link to a JIRA ticket or a Github issue, if there is one.
• changelog.d contains the following bits of information (details):
  • A file with the changelog entry in one or more suitable sub-sections. The sub-sections are marked by directories inside changelog.d.

[fisx]

I would prefer using the team end-point (GET /i/teams/:tid/features/sndFactorPasswordChallenge). You could easily get the team id from the user id or bot id in the handlers; ie. checkAllowed would be something like :: UserId -> Handler r () and be called first thing inside the handler, not from outside of it.

The only arguable downside I can see is that the block is buried inside the handler logic rather than in being visible in the routing table. But the big advantage is that the block will be effective for all situations in which the feature is enabled.

[fisx]

LGTM! (I don't need to re-approve the upcoming integration test if you and concourse agree that it's good.)