Encrypt TOTP keys

[dd32]

Fixes #101

Depends upon WordPress/wporg-mu-plugins#390
Made possible by WordPress/two-factor#546

NOTE: if you test this on a sandbox (and then remove this), you will be unable to login with TOTP again without deactivating TOTP.

Testing Instructions:

• Make sure you're running a version of two-factor with Add a filter to filter the classname used for a provider two-factor#546 merged
• Define WPORG_ENCRYPTION_KEY and optionally WPORG_TWO_FACTOR_ENCRYPTION_KEY, with a value from \WordPressdotorg\MU_Plugins\Encryption\generate_encryption_key()
• View _two_factor_totp_key value. Validate that it appears plaintext.
• Login with TOTP.
• View _two_factor_totp_key value. Validate that it appears to be encrypted (Long, and prefixed with $t1$).
• Deactivate TOTP.
• Setup TOTP.
• Validate everything worked as expected.

TODO:

• Unit Tests.
• Add Encryption methods. wporg-mu-plugins#390 (This is not required prior to this merging, but is required for it to actually encrypt)
• Test once 390 is merged
• Test on production sandbox, verify TOTPs are upgraded upon login.

[pkevan]

Tested on a sandbox, and confirmed the TOTP key is encrypted, and you can log in once it has been encrypted.

[dd32]

I've updated this to include the User ID as part of the encryption, such that user_meta for one user is invalid for another.
(I've 'upgraded' the existing encrypted TOTP keys on WordPress.org).

I've updated the unit tests to test that the key is stored in a format different than the key (ie. encrypted) but left the validation of the encryption functions to the Encryption library PR.
edit: Of course this doesn't actually pass yet.. as the encryption methods aren't merged.. 3d89b20 can be reverted once the upstream PR is merged.