Single sign on for RCPCH users

[mbarton]

Sync with NPDA rcpch/national-paediatric-diabetes-audit#1093

RCPCH E12 team members (or anyone @rcpch.ac.uk) should login using single sign on. We still want to enforce two factor auth, I think either

Send the magic OAuth query parameter that forces a 2fa login
Retain additional 2fa in the platform for RCPCH users