fix: update aal requirements to update user

[J0]

What kind of change does this PR introduce?

If a user has verified factors (mfa enabled) we should require an AAL2 session in order to proceed with any operation

We restrict phone, email, and password from updates as we consider those as sensitive fields

Context: https://supabase.slack.com/archives/C02AK9166FR/p1725466764804889

[coveralls]

Pull Request Test Coverage Report for Build 10812950524

Warning: This coverage report may be inaccurate.

This pull request's base commit is no longer the HEAD commit of its target branch. This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

• For more information on this, see Tracking coverage changes with pull request builds.
• To avoid this issue with future PRs, see these Recommended CI Configurations.
• For a quick fix, rebase this PR at GitHub. Your next report should be accurate.

Details

• 4 of 10 (40.0%) changed or added relevant lines in 2 files are covered.
• 4 unchanged lines in 1 file lost coverage.
• Overall coverage decreased (-0.01%) to 57.908%

---

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
internal/api/user.go	1	4	25.0%
internal/models/user.go	3	6	50.0%

Files with Coverage Reduction	New Missed Lines	%
internal/models/cleanup.go	4	88.37%

Totals
Change from base Build 10684529517:	-0.01%
Covered Lines:	9142
Relevant Lines:	15787

---

💛 - Coveralls

[cstockton]

Code wise I see no issues long as the logic behind the added checks is sound.