Add a two-step setup of OTP

Before this change, 2FA with OTP was enabled before the user was able to
submit a code to validate the setup. Thus, this could lead to a
situation where the user is locked out of her account if there was an
issue setting up her application.

Now we rely on a new boolean property that is set to true only after the
user submits a valid code during the setup phase.

Fixes #4867

Signed-off-by: Kevin Decherf <kevin@kdecherf.com>

tests/Controller/SecurityControllerTest.php

@@ -66,6 +66,7 @@ class SecurityControllerTest extends WallabagTestCase
             ->getRepository(User::class)
             ->findOneByUsername('admin');
         $user->setGoogleAuthenticatorSecret('26LDIHYGHNELOQEM');
+        $user->setGoogleAuthenticator(true);
         $em->persist($user);
         $em->flush();
 
@@ -78,6 +79,7 @@ class SecurityControllerTest extends WallabagTestCase
             ->getRepository(User::class)
             ->findOneByUsername('admin');
         $user->setGoogleAuthenticatorSecret(null);
+        $user->setGoogleAuthenticator(false);
         $em->persist($user);
         $em->flush();
     }