Add TOTP multi-factor authentication support

[jeffreylo]

An attempt to see https://github.com/keratin/authn-server/pull/133 through. Squashed and rebased against v1.11.0.

My understanding is that we may need a way to try this out before we feel comfortable merging — is that right, @cainlevy?

[cainlevy]

Yes that's right. I will make time to review and refresh my memory on what the next steps are. Maybe the best way to handle this is with a pre-release, or just advertise it as unstable until it's been implemented in a production environment at least once. 🤔