Allow submission of one-time password on API calls

Feature Request

Not sure if this feature request belongs here or in the server repository 🤔 Sorry if it's the wrong one.

The use of one-time passwords is a nice security enhancement and I would like to enable it for all users, but I think there is a use case that hasn't been anticipated yet.

Login through the web interface lets you provide user credentials and totp, external applications can use app passwords but afaik (trusted) external applications that let the user enter their credentials cannot access totp protected accounts.
I haven't found a way to supply the one-time password to the API. Github for example supports the X-GitHub-OTP header.

Use case: For security reasons I do not want to store an app password in an external application (at least not yet) but instead let users provide their credentials including totp to a form when needed.

Summary

Support the submission of one-time password on API calls (e.g. user metadata).

First determine whether this belongs in twofactor_totp or the Nextcloud server repository, then trace the API authentication path and the user metadata endpoint mentioned in the request. Done means defining and implementing a secure way for API callers to submit a one-time password for TOTP-protected accounts, with tests covering the behavior.