[Request] Allow locking session to IP address

[Roardom]

Add a user setting that by default requires all sessions to be locked to the IP address.

On the 2fa code input page after signing in, if this user setting is enabled, then show a tick box that allows not locking the session to the IP. There can be a message describing how it's less secure and is only useful for mobile devices that change IP frequently.

This means that a user has to do the following to allow not having session locked to ip:

• Have 2fa enabled
• Enabled the user setting
• Ticked the box after signing in

The IP can be stored encrypted in the user's browser cookies and not saved in the redis session stored on the server. Middleware can decrypt it every request and log the user out of that session if their IP changes. Additionally send the user a system message saying their account was attempted to be logged into via an existing cookie session using an unknown IP.