feedback: xml-rpc settings UI can be simplified

Some feedback. The plugin’s settings UI for the two XML-RPC settings can be simplified and better match both the code’s functionality and cognitive understanding.
In v1.0.4, the setting UI has two options:
* require 2fa for XMLRPC call auth -> skipped or required
* disable XML-RPC auth -> yes/no

This is actually a single option that has three possible values. It can be reworded something like…
XML-RPC calls requiring authentication -> blocked, standard, 2fa-required

Or if you want to keep them as two separate options, then restructure them. Why? Because the ‘disable xml-rpc auth’ option overrides the other. It is the master switch. So I recommend in this two option approach to list the ‘disable xml-rpc auth’ first and make it visually the main. And after it, probably indented and only enabled when its parent is checked, list the ‘skipped/required’ setting.