FIX: Disable security keys at same time as TOTP 2FA (#10144)

Previously, the "Remove 2FA" button could result in an error. This syncs button visibility with behavior.

* FIX: Only offer disabling 2FA to admins

app/serializers/admin_detailed_user_serializer.rb

@@ -44,7 +44,7 @@ class AdminDetailedUserSerializer < AdminUserSerializer
   end
 
   def can_disable_second_factor
-    object&.id != scope.user.id
+    scope.is_admin? && (object&.id != scope.user.id)
   end
 
   def can_revoke_admin