Update devise-two-factor to 4.0.2

Merge branch 'security-update-devise-two-factor' into 'master'

See merge request gitlab-org/security/gitlab!2342

Changelog: security