Add support for OAUTH HOTP and TOTP

This is described under the following RFCs:

https://datatracker.ietf.org/doc/html/rfc4226
https://datatracker.ietf.org/doc/html/rfc6238

This feels like it will be better handled by a wrapper realm which can verify evidence using credentials obtained from the wrapped realm. In the case of HOTP the wrapped realm will need to be a ModifiableRealm so the credential can be written back after the counter is incremented.

QR Code Format for Google Authenticator:
https://github.com/google/google-authenticator/wiki/Key-Uri-Format