[AI assisted]: MM-62914: Added MFA authentication for plugin requests as well (#30160)

We wipe the token if MFA authentication is enabled. Also added a test case
to lock in the functionality.

https://mattermost.atlassian.net/browse/MM-62914

```release-note
NONE
```

server/channels/app/plugin_requests.go

@@ -16,6 +16,7 @@ import (
 	"github.com/mattermost/mattermost/server/public/model"
 	"github.com/mattermost/mattermost/server/public/plugin"
 	"github.com/mattermost/mattermost/server/public/shared/mlog"
+	"github.com/mattermost/mattermost/server/public/shared/request"
 	"github.com/mattermost/mattermost/server/v8/channels/utils"
 )
 
@@ -146,16 +147,33 @@ func (ch *Channels) servePluginRequest(w http.ResponseWriter, r *http.Request, h
 		token = r.URL.Query().Get("access_token")
 	}
 
+	// If MFA is required and user has not activated it, we wipe the token.
+	app := New(ServerConnector(ch))
+	rctx := request.EmptyContext(ch.srv.Log()).WithPath(r.URL.Path)
+
+	// The appErr is later used at L176 and L226.
+	session, appErr := app.GetSession(token)
+	if session != nil {
+		rctx = rctx.WithSession(session)
+	}
+
+	if mfaAppErr := app.MFARequired(rctx); mfaAppErr != nil {
+		pluginID := mux.Vars(r)["plugin_id"]
+		ch.srv.Log().Warn("Treating session as unauthenticated since MFA required",
+			mlog.String("plugin_id", pluginID),
+			mlog.String("url", r.URL.Path),
+			mlog.Err(mfaAppErr),
+		)
+		token = ""
+	}
+
 	// Mattermost-Plugin-ID can only be set by inter-plugin requests
 	r.Header.Del("Mattermost-Plugin-ID")
 
 	r.Header.Del("Mattermost-User-Id")
 	if token != "" {
-		session, appErr := New(ServerConnector(ch)).GetSession(token)
-
 		csrfCheckPassed := false
-
-		if session != nil && appErr == nil && cookieAuth && r.Method != "GET" {
+		if (session != nil && session.Id != "") && appErr == nil && cookieAuth && r.Method != "GET" {
 			sentToken := ""
 
 			if r.Header.Get(model.HeaderCsrfToken) == "" {