Tracking upstream MVP issues

[iandunn]

These are upstream issues that we want/need done during the MVP milestone.

Harden

• Harden login nonces two-factor#473
• Generate QR codes locally with JS two-factor#487
• Register the TOTP QR generation script on the front-end. two-factor#495
• Add Security Policy two-factor#481
• Block sending authentication cookies upon 2FA login two-factor#502
• Backup Codes: Always generate 10 codes via REST two-factor#514
• Core: Reset compromised passwords after 2FA failures two-factor#482 and/or Add rate limiting to two factor attempts. two-factor#510
• TOTP: Enforce single-use of TOTP one-time passwords. two-factor#517

Automated Testing

• Increase TOTP coverage two-factor#469
• Update PHPUnit, Install phpunit-watcher two-factor#472
• Tests: Explicitly ignore directories for performance two-factor#474
• Tests: Migrate config to 9.5 format two-factor#475

Misc

• Fix Backup code download with quotes in translations two-factor#494
• Use the Rest API for setting up individual providers two-factor#504 - Blocker for our custom UI
• Pin two-factor SVN external to a trunk revision after 504 merges, because it's currently pinned to Dion's branch