Require email confirmation for TOTP-based logins

[di]

Fixes #18425.

This PR maintains a record of device information across logins for each user:

• For TOTP logins, confirmation via a link sent to the primary email is required for each new device;
• For non-TOTP logins, no confirmation is required.

[miketheman]

Lots of comments inline. Let me know if they need further details.

Aside: I wonder if there's an opportunity to use these kinds of "annoying" interactions to push webauthn more, but I still want that to be a smoother experience.

[miketheman]

Other than the migration needing a rebase, I think this looks good to me - I'd prefer if at least one other admin reviews as well.

resolved