Two factor authentication for both login variants

[pabzm]

This adds optional two factor authentication based on shared TOTP-secrets to both login variants (password and AIO token authentication).

The 2FA can be enabled as soon as the containers are running in a section below the backup configuration. As long as it is not enabled, the AIO UI shows a warning at the top, and inside the Nextcloud a notification is shown to all Nextcloud admins, strongly recommending to enable it. The Nextcloud admin notification is sent via the mastercontainer's cron.sh, thus will be renewed whenever it is dismissed.

In order to show the notices, this PR includes a notification system for the AIO UI, providing two variants: notices, and warnings. Notices have a green background and border and vanish after 5 seconds. Warnings have a orange-leaning yellow background and border and don't vanish (and can't be dismissed manually, neither).

Another visual improvement is highlighted section headlines: If the URL hash matches an h2 element's ID, the h2 is highlighted and if the h2 is followed by a detail element, that detail is opened. If effect, browsing to #two-factor-auth jumps to the section, which is highlighted and opened already (as shown in the second screenshot below).

The libraries are the same as used in https://github.com/nextcloud/twofactor_totp, to stay consistent with Nextcloud.

Screenshots are below.

Summary

• The PR was tested and verified that it works locally
• Or will be tested after merge on a dedicated test instance (available for maintainers)
• Sign-off message is added to all commits
• Tests (playwright if possible) are included
• Screenshots before/after for front-end changes
• Documentation has been updated or is not required
• Labels added where applicable (ex: bug/enhancement, 3. to review, feature component)
• Milestone next added

AI (if applicable)

• The content of this PR was partly or fully generated using AI

Screenshots

After the containers are up and running:

---

After the link in the warning was clicked:

---

The same section if the link wasn't clicked but the page was scrolled down:

---

After 2FA was enabled successfully:

---

The section's detail has a different summary and changed content now:

---

Logging in with the password (after stopping the containers) requires a 2FA code now:

---

If logging in via Nextcloud's admin link (AIO token), the 2FA code is required, too:

---

Inside Nextcloud a nagging notification is shown to all admins:

[pabzm]

The "Docker lint" check is unrelated to the changes of this PR (will be improved or fixed in #8598)