Unlock the integrated TOTP authenticator separately from the password manager (improve 2FA security)

I have merged two related threads (“Separate password for access to the integrated authenticator” and “TOTP - protect with second master password”).

Furthermore, the topic title has now been changed to “Unlock the integrated TOTP authenticator separately from the password manager” in recognition of the fact that some users may prefer other unlock methods than entering a second password, and the fact users may have different preferences for how often the authenticator unlocking mut be performed (hence, it is likely that this feature will need to include configurable timeout settings for the authenticator locking).