SALTO-6367: Adjust migrated MFA policies to Identity Engine format in Okta

[shir-reifenberg]

Adjust MFA policies on identity engine accounts during fetch

---

Additional context for reviewer

The change is needed in order to -

1. Parse references correctly to authenticators (currently the string to reference for was a map key, so I switched it to value)
2. The nacl at its current state is not deployable for Identity Engine accounts, because the Okta API expect it to be in the AUTHENTICATORS format

---

Release Notes:
Replace me with a short sentence that describes changes that will appear in NaCls and are not caused by user actions (e.g. a new annotation, field values that are converted to references, etc). Hidden changes should not be listed.

---

User Notifications:
Replace me with a short sentence that describes changes that will appear in NaCls and are not caused by user actions (e.g. a new annotation, field values that are converted to references, etc). Hidden changes should not be listed.

[coveralls]

coverage: 93.773% (+0.02%) from 93.751%
when pulling d0754db on shir-reifenberg:SALTO-6367-AlignMfaEnrollmentTypes
into 74a38c9 on salto-io:main.

[omrifarkash]

I don't fully understand why is this change needed. I find the old code of excluding types from the definitions more readable and yield the same results?

Lets talk f2f :)