docs: improve two-factor authentication documentation outline

[wbolster]

This improves the document structure for the HOTP and TOTP docs. Both now have a heading at the same level, so that both appear in the navigation sidebar.

Before this change, HOTP had an autogenerated heading, while TOTP was incorrectly hidden as a subsection of the HOTP section, due to Sphinx automatically adding sub-headings for :class: blocks.

Also lift the section about the provisioning URI to a sibling level, since it applies equally to HOTP and TOTP.

[wbolster]

for easier review, fully expanded outline before (incorrect):

Two-factor authentication
- InvalidToken
- HOTPHashTypes
- HOTP (class)
- Throttling
- Re-synchronization of the counter
  - TOTP (class)
- Provisioning URI

… and after (improved):

Two-factor authentication
- InvalidToken
- HOTP
  - HOTPHashTypes
  - HOTP (class)
  - Throttling
  - Re-synchronization of the counter
- TOTP
  - TOTP (class)
- Provisioning URI