Warn on users with password login and without MFA devices

Raise a low-score alert for users with password login enabled
and no MFA devices. Rationale is that this is probably a human
user which would be better protected by 2FA.

Signed-off-by: Luca Bruno <luca.bruno@rocket-internet.de>
Merge pull request #46 from lucab/lucab/to-upstream/password-without-mfa

Warn on users with password login and without MFA devices