Redirect loop for recovery at 2fa stage

See description here: https://github.com/ory/kratos/discussions/3605 .

To mostly prevent this case form happening, we're removing the "Set new password" link from the TOTP form, but the underlying issue is still there, and if you're unlucky you can still hit it by starting a recovery after entering credentials and before entering 2fa.