Send a push notification to step up a token

Starts step-up by sending a push notification to a device belonging to the logged-in user, as an alternative to the one-time password variant.

The channel is AUTHY or BIOMETRIC, and the device must have been enrolled beforehand through /authentication_factors/push/{channel}. The user approves the challenge on their device, so unlike the one-time password flow there is no code to collect and no verify call to make. The response returns the challenge id for correlating the notification you sent with the approval that follows.

Only start this if a step-up isn't already in flight for the token.

Once approved, the access token you are already using is raised to STEPPED_UP in place. Retry the operation that required step-up with the same token.