Add TOTP watermark support
    
    This prevents the reuse of TOTP tokens by recording the last token
    interval that was used. This will be replicated as normal. However,
    this patch does not increase the number of writes to the database
    in the standard authentication case. This is because it also
    eliminates an unnecessary write during authentication. Hence, this
    patch should be write-load neutral with the existing code.
    
    Further performance enhancement is desired, but is outside the
    scope of this patch.
    
    https://fedorahosted.org/freeipa/ticket/4410
    
    Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>