Generate QR codes locally with JS

[iandunn]

Fixes #42
Closes #388 - This is an alternate approach, which addresses the concerns I raised there.
Closes #443 - There won't be an external URL to filter anymore. This has filters for the local URL, though

I don't think a PHP fallback is needed, since disabling JS is extremely rare, and the manual secret already serves that purpose.

[iandunn]

@kasparsd , @dd32 : I'll be AFK until the 2nd, so don't hesitate to make any changes y'all see fit in my absence. I'm also happy to pick up back up when I return.

[dd32]

Additionally, It would be worth changing this from just a QR image, to also linking to the otpauth url.
That allows for those setting up on mobile (...and desktop) to simply click the QR image which loads up their Authenticator app.

Ie.

-<p id="two-factor-qr-placeholder">QR</p>
+<a id="two-factor-qr-placeholder" href="otpauth://....">QR</a>

I've tested this on mobile and desktop, and works as expected with FreeOTP, Yubico Authenticator, and the Apple Password Manager.

[iandunn]

also linking to the otpauth url

That's a good idea, done in 68ed4f2

[kasparsd]

This needs to be escaped with esc_url().

[iandunn]

It is escaped above (same w/ the other). Normally I'd escape as late as possible, but this one needs the extra param for the otpauth protocol, which would make those echos fairly long and less readable, and duplicated instead of DRY.

I don't feel strongly either way though. I'm happy to change it if you'd prefer.