One time token authentication filter should be its own class

[Kehrlann]

Expected Behavior

Authentication processing for one-time login token should happen in a dedicated filter class.

(Discussed with @rwinch)

Current Behavior

Authentication processing happens in an undifferentiated instance of AuthenticationFilter, see OneTimeTokenLoginConfigurer.

Context

This will help implement gh-16414 .