Add option to skip MFA for vpn_auth connections

For our use case, we found it was best to force Duo secondary authentication for logins via the web UI (user & admin login) but skip the hassle of the challenge / response flow when a certificate is presented for vpn_auth.

This diff adds a new global setting `SKIP_DUO_ON_VPN_AUTH` that shortcuts the need for MFA if `vpn_auth` is True in the attributes dictionary. The original script behavior is the default.