[Core] Add Support for TOTP / 2FA to LORIS

[driusan]

This adds support for time based one time passwords (TOTP) to LORIS based on RFC6238 (the standard used by authenticator apps such as Authy or Microsoft Authenticator).

There is a new subpage of my_preferences where a user can register an authenticator app to their account using a QR code. After validating the code, the secret key used to generate it is saved to the users table. After this point, any attempts to log in will check if they have a valid 2FA code by using a new MFA middleware. The middleware intercepts requests and prompts for the code if it has not yet been provided.

Testing instructions:

1. Using the same authenticator app that you use for other sites, set up MFA for your account using the "Configure MFA" link on my_preferences.
2. Log out
3. Attempt to log in

[driusan]

@kongtiaowang is putting this on a VM for @charliehenrib to test.

[charliehenrib]

@driusan It is working well following your testing steps above.
FYI, I used Microsoft authenticator.

[charliehenrib]

@driusan I just noticed that the breadcrumbs for my preferences actually brings you back to the home (dashboard) page. I think this should be fixed.

Also, why do the breadcrumbs say "Configure 2FA" rather than keeping the same language as the previous page "Configure MFA"

[charliehenrib]

Not a blocker for this PR, but something to consider, do we want to spell out MFA to improve user experience:

Same here:

[charliehenrib]

I get the following error when adding manually...

On the app, it says my account was added successfully. I will try again with a new LORIS account to see if it works. --> Confirmed that manual setup is not working

[jeffersoncasimir]

Very cool feature!

[driusan]

@charliehenrib I fixed the breadcrumbs and manual code input. I also changed the link to explicitly spell out "multi-factor authentication" but left the acronym on the page since you have to click on the link to get there and expanding it in some places would sound weird (ie. "multi-factor authentication authenticator")

[driusan]

@jeffersoncasimir I have committed your suggested changes (and fixed a bug where they caused the automatic digit progression to stop working..)

[jeffersoncasimir]

LGTM!

[charliehenrib]

LGTM for manual testing. The only thing that you could add, but is not essential for this PR is to update the test plan for my_preferences.