Let users choose between SMS and TOTP during first login

[reefdog]

When users first log in, we should let them choose betweeen SMS and TOTP, and then continue setup.

This may come for "free" with the work done on #19, but I wanted to be sure to explicitly capture the need.

[bickelj]

I think this suggestion is more tractable than trying to modify the "try another way" form to show all options minus the option from which they came. It would be something like:

• A new user attribute indicating a preference.
• Login flow requires this attribute to be set after entering passphrase.
• Based on the value of this attribute go only to SMS or TOTP.

The stickier part might be attempting to change this attribute.

[reefdog]

I was reminded of this when signing up for a Login.gov ID, and prompted with this excellent screen: