Custom 2FA permission for non-superusers

[katdom13]

• A project we're working on wanted some of their user groups to be able to manage other users' 2FA devices without granting full superuser access. This adds a narrower manage_2fa_devices permission
  (configurable via the new WAGTAIL_2FA_MANAGE_DEVICES_PERMISSION setting).
• Removes the hard-coded check against the built-in User model's change_user permission. Permission checks now derive from the project's actual AUTH_USER_MODEL, so this works correctly for projects using a
  custom user model.