TOTP verification should be important factor post scanning to onboard

[godwinpinto]

Feature
Currently the TOTP request does not verify if the scanned output is valid. There might be cases where there is disconnect in the users device. Therefore, one should not be on-boarded if the TOTP is verified once. Allowing a user to regenerate until then.

Solution
Mark the TOTP record as pending status until a verification request is called. Create one more request that validates user for TOTP only after which user can be on-boarded and then turn the status to Active.