TFA migration from d.o to Keycloak

Not directly related to migrating of MFA/TFA, but by default there isn't a mechanism to generate recovery codes. https://github.com/thomasdarimont/keycloak-extension-playground/tree/master/auth-backup-codes provides that feature though.