Ref T10603. For LFS, we need to issue a new type of temporary token.

This makes the temporary token code modular so applications can add new token types without modifying the Auth application.

(I'm moving slowly here because it impacts authentication.)

• Used bin/auth recover to get a one-time token from the CLI.
• Used "Forgot your password?" to get a one-time token from the web UI.
• Followed the web UI token to initiate a password reset, prompting generation of a password token.
• Viewed these tokens in the web UI:

• Revoked a token.