MM-63195: Enforce MFA requirement for non-self requests (#30290)

https://mattermost.atlassian.net/browse/MM-63195

```release-note
NONE
```

server/channels/api4/user.go

@@ -1650,7 +1650,12 @@ func updateUserMfa(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if user, err := c.App.GetUser(c.Params.UserId); err == nil {
+	if appErr := c.App.MFARequired(c.AppContext); !c.AppContext.Session().Local && c.AppContext.Session().UserId != c.Params.UserId && appErr != nil {
+		c.Err = appErr
+		return
+	}
+
+	if user, appErr := c.App.GetUser(c.Params.UserId); appErr == nil {
 		audit.AddEventParameterAuditable(auditRec, "user", user)
 	}
 
@@ -1672,8 +1677,8 @@ func updateUserMfa(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	c.LogAudit("attempt")
 
-	if err := c.App.UpdateMfa(c.AppContext, activate, c.Params.UserId, code); err != nil {
-		c.Err = err
+	if appErr := c.App.UpdateMfa(c.AppContext, activate, c.Params.UserId, code); appErr != nil {
+		c.Err = appErr
 		return
 	}