Move canUpdateSfa to 2FA Engine (#2803)

Preliminary step in order to fix #2803 (closed)

I think it's best if the security checks are done in the engine and not in the 2FA register modules, to avoid copy/paste mistakes and code duplication

@maudoux can you give me your opinion and if you agree, check if it breaks the contextSwitchingRule/impersonationRule cases ?