api: tfa: don't block tokens from viewing and list TFA entries

api: tfa: don't block tokens from viewing and list TFA entries

The `allowtoken` property is a total, unconditional block on using
API tokens on an endpoint. We reserve those only for a limited set of
security critical endpoints like changing passwords or second
factors, or creating a (cookie) ticket, which are exempt from this
limitations, so require to have limited access to them too.

Anyhow, listing and getting TFA entries for users, where the API
token has the correct permissions granted, is not critical, as the
API token cannot gain more permissions than they have from that
info, so drop the total block on those GET methods.

Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>