Warn on users with password login and without MFA devices

Raise a low-score alert for users with password login enabled
and no MFA devices. Rationale is that this is probably a human
user which would be better protected by 2FA.

Signed-off-by: Luca Bruno <luca.bruno@rocket-internet.de>