Merge branch '2fa-no-autocomplete' into 'master'

Disable 2FA field autocomplete, resolves #18021.

Self-explanatory. Fixes #18021.

cc: @jschatz1 @jacobvosmaer-gitlab 

See merge request !4385

app/views/devise/sessions/two_factor.html.haml

@@ -5,7 +5,7 @@
     .login-body
       = form_for(resource, as: resource_name, url: session_path(resource_name), method: :post) do |f|
         = f.hidden_field :remember_me, value: params[resource_name][:remember_me]
-        = f.text_field :otp_attempt, class: 'form-control', placeholder: 'Two-factor Authentication code', required: true, autofocus: true
+        = f.text_field :otp_attempt, class: 'form-control', placeholder: 'Two-factor Authentication code', required: true, autofocus: true, autocomplete: 'off'
         %p.help-block.hint Enter the code from the two-factor app on your mobile device. If you've lost your device, you may enter one of your recovery codes.
         .prepend-top-20
           = f.submit "Verify code", class: "btn btn-save"