If a local group requires 2FA from its members, we currently prevent them from disabling 2FA (T414952). We'd like to have the same behavior for global groups as well.

Acceptance criteria

• Special:AccountSecurity recognizes global groups which require 2FA.
• If member of 2FA-required global groups has more than one 2FA method, they are allowed to remove any of them.
• If member of 2FA-required global groups has exactly one 2FA method, they cannot remove it.
• If member of 2FA-required global groups is prevented from disabling their last 2FA method, they are presented with a message instructing them where they could go and ask for having the relevant global groups removed.