Document require TFA and UX challenge

Requiring TFA will block any user from authenticating when that user hasn't setup TFA. That's all well and good but it presents a challenge for site administrators to figure out how to get the user setup with TFA without removing the restriction.

The easiest and probably solution is for the administrator to downgrade the account to a role that doesn't require TFA, thus allowing them to authenticate. The idea being that if admin roles are required to have TFA and a user doesn't have TFA setup, by removing that role they can authenticate but not access anything their admin role grants them. Once they setup TFA (setup must be granted to the lower role) then the admin can re-grant the admin role.

Documenting this in TFA module or on drupal.org would be helpful for TFA administrators.