This is a follow-up to a production incident
See https://gitlab.com/gitlab-com/gl-infra/production/-/issues/16022#note_1467672642.

The incident happened because some new validations were added that
were preventing existing user records from getting updated.
We save the user when doing 2FA sign-in so users not passing the
validations were unable to sign in.
ActiveRecord::RecordInvalid caused the SessionsController to return
422 but we have changed that to 500 to improve observability/alerting.

Changelog: other