Implement Credential Providers

Credentials should be provider based, currently it is only hard coded to be password based.

We'll want one for an offline-recovery key.

We'll also want to support composite provider of two or more other providers, e.g. a password and a file, someday maybe a password and a remote blob based on an TOPT challenge.