Since #16964, `tsh login` defaults to passwordless if it finds suitable platform
credentials - it is safer and more convenient than other authentication methods.
Unfortunately, it is a bit too eager in doing that.
This change adds the following prerequisites for the switch, in addition to
existing conditions:
1. `--auth` must not be specified
2. `--mfa-mode` must be either `auto` or `platform`
(1) avoids defaulting when `--auth=local` is present, as well as for other
custom/future values. (If `--auth=passwordless` is passed, we'll do passwordless
anyway.)
(2) includes both an explicit platform attachment test (which is a bit more
conservative in face of changes), as well as checking for `--mfa-mode=otp`.
#20429 and #20322
Alan Parra
7b7c4adbe0