Add tests for role-based Two-Factor enforcement

[thomasfedb]

Adds PHPUnit coverage for the role-based enforcement introduced in WordPress/two-factor#845, in a new tests/two-factor-enforcement.php (10 tests):

• Email provider injected for enforced-role users with no configured providers (and is_user_using_two_factor() becomes true)
• Users outside enforced roles unaffected; no enforcement when the option is unset
• A user's own provider configuration is never overridden
• Fails closed: no injection when the Email provider is disabled site-wide
• Secondary roles are matched
• New-user enrolment at registration, including both skip paths (role not enforced, Email disabled)
• Uninstall removes both settings options

The upstream Copilot review on WordPress#845 flagged the missing test coverage; this should help get the feature merged.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Unlinked Accounts

The following contributors have not linked their GitHub and WordPress.org accounts: @thomasfedb.

Contributors, please read how to link your accounts to ensure your work is properly credited in WordPress releases.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Unlinked contributors: thomasfedb.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.