Try and treat sub-par authentication as if SP requested ForceAuthn.

If an SSO session exists with authentication at e.g. level
'eduid.se:level:1', and the AUTHN_BROKER says the acceptable Authn
levels
for the requested AuthnContext are ['eduid.se:level:2',
'eduid.se:level:3'] it seems reasonable that the eduID IdP should
handle the request like the SP requested ForceAuthn.