Check SendGrid 2FA enforcement scope

Add a best-effort MFA status check to the SendGrid access-review
fetch pipeline by querying teammate details and inspecting 2FA scopes.

When teammate scopes include 2fa_required or 2fa_exempt, map those
to ENABLED or DISABLED MFA status values; otherwise keep UNKNOWN.

Extend the SendGrid cassette and tests to cover the detail lookups and
MFA scope mapping behavior.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>

pkg/accessreview/drivers/sendgrid_test.go

@@ -42,18 +42,21 @@ func TestSendGridDriver(t *testing.T) {
 	assert.True(t, owner.IsAdmin)
 	assert.Equal(t, "owner-user", owner.ExternalID)
 	assert.Equal(t, coredata.AccessEntryAccountTypeUser, owner.AccountType)
+	assert.Equal(t, coredata.MFAStatusEnabled, owner.MFAStatus)
 
 	admin := records[1]
 	assert.Equal(t, "admin@example.com", admin.Email)
 	assert.Equal(t, "Admin", admin.Role)
 	assert.True(t, admin.IsAdmin)
 	assert.Equal(t, "admin-user", admin.ExternalID)
+	assert.Equal(t, coredata.MFAStatusEnabled, admin.MFAStatus)
 
 	teammate := records[2]
 	assert.Equal(t, "teammate@example.com", teammate.Email)
 	assert.Equal(t, "Teammate", teammate.Role)
 	assert.False(t, teammate.IsAdmin)
 	assert.Equal(t, "teammate-user", teammate.ExternalID)
+	assert.Equal(t, coredata.MFAStatusDisabled, teammate.MFAStatus)
 }
 
 func TestSendGridRole(t *testing.T) {
@@ -113,3 +116,24 @@ func TestSendGridResponseItems(t *testing.T) {
 		assert.Equal(t, "fallback@example.com", items[0].Email)
 	})
 }
+
+func TestSendGridMFAStatus(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name   string
+		scopes []string
+		want   coredata.MFAStatus
+	}{
+		{name: "required", scopes: []string{"mail.send", "2fa_required"}, want: coredata.MFAStatusEnabled},
+		{name: "exempt", scopes: []string{"mail.send", "2fa_exempt"}, want: coredata.MFAStatusDisabled},
+		{name: "unknown", scopes: []string{"mail.send"}, want: coredata.MFAStatusUnknown},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			assert.Equal(t, tt.want, sendGridMFAStatus(tt.scopes))
+		})
+	}
+}