Support TOTP as a second factor.

[jimsynz]

No description provided.

[chazwatkins]

I'm converting an existing application to Ash that has a totp implementation. When I finish up porting the totp to Ash, I'll look into contributing totp to ash_authentication in Q1 2025.

Is anyone working on adding totp already? If not, I'll plan to add this feature.

[chazwatkins]

Also, would it be better to contribute the new strategy in ash_authentication or to create an extension package ash_authentication_totp? Doing the extension would avoid ash_authentication from bloating it's dependencies for a strategy that may or may not be used.

[zachdaniel]

It would have to depend on the details of the implementation, but starting it in its own package can't hurt. we can always do optional dependencies and tell the user to add deps to avoid bloating our deps. So once it is ready we can decide :)