Configuration to Require MFA For Login to Registry

It should be possible to require MFA to login to Registry, which is currently difficult or impossible for certain configuration where Enrollment Flows may try to set up MFA (and therefore can't require it).

Ideally the approach should be compatible with MeemEnroller configurations.