Update 2FA workflow esp with warning to not give hints

This MR makes a few changes most being minor reorganization of points to fit better in the steps taken and minor wording changes.

Less minor changes:

1. Add note on ensuring to check for large customers workflow and where
2. Add note not to give hints to answers (as requested by @ralfaro )
3. Adds example on clarifications we can ask for
4. Correct instructions for GitLab employees
5. Fix instructions now that challenges are in auto-responder