Bump devise-two-factor gem to v3.1.0

This version locks down the Rails dependency version and
fixes Devise's paranoid-mode:
https://github.com/tinfoil/devise-two-factor/pull/138

Full list of changes:
https://github.com/tinfoil/devise-two-factor/compare/v3.0.3..v3.1.0

Closes https://gitlab.com/gitlab-org/gitlab/issues/207413