Explicitly allow access on some (public) routes also without 2FA

[ChristophWurst]

Fixes nextcloud/twofactor_totp#1147 and many similar bugs in 2FA apps.

This is kind of a revert of #28725, or another revision. The problem is that we have some public routes (@PublicPage) that should be accessible during the 2FA setup. That is after the login (user context exists) but before completing any 2FA challenge or setting up a 2FA provider (other routes have to remain blocked).

This new annotation will allow us to mark (public) routes to be accessible again.

This follows @nickvergessen's suggestion from #29056 (comment)

We will have to add this annotation to the 2FA provider routes.

[nickvergessen]

I think it's the best approach, but we should document properly that this is only supposed to be used by twofactor apps?

[ChristophWurst]

I think it's the best approach

In an ideal world we would be able to load @PublicPage without user context until 2FA is disabled. Then enabling all public pages again wouldn't be dangerous. But I have no idea how we could achieve that. At least not easily.

[nickvergessen]

In an ideal world we would be able to load @publicpage without user context until 2FA is disabled. Then enabling all public pages again wouldn't be dangerous. But I have no idea how we could achieve that. At least not easily.

Well not sure I agree here. Without the context how should the 2fa apps know it?
But anyway let's go with the approach above for now

[ChristophWurst]

/backport to stable23

[ChristophWurst]

/backport to stable22

[ChristophWurst]

/backport to stable21

[ChristophWurst]

/backport to stable20

[backportbot-nextcloud]

The backport to stable23 failed. Please do this backport manually.

[backportbot-nextcloud]

The backport to stable21 failed. Please do this backport manually.

[backportbot-nextcloud]

The backport to stable20 failed. Please do this backport manually.

[backportbot-nextcloud]

The backport to stable22 failed. Please do this backport manually.