feat(session): TOTP Check API with relation tables (#11886)

# Which Problems Are Solved

As part of #11035 , this PR implements the TOTP check logic for session
validation

# How the Problems Are Solved

  - Implement TOTP check logic and tests
- The tarpit function has been moved to a common file so that it can be
used by both TOTP and password checks
- Manual transaction management to avoid stalling the DB while verifier
function is executed
- Update `database.Change` `Matches()` function to allow comparison of
`time.Time` values
  - A converter package from GRPC to Domain model has been added

# Additional Context

This is a cherry-picked PR + changes, coming from
https://github.com/zitadel/zitadel/pull/11164
- Relates to #11035

backend/v3/storage/database/change.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"reflect"
 	"slices"
+	"time"
 
 	"go.uber.org/mock/gomock"
 
@@ -40,6 +41,19 @@ func (c *change[V]) Matches(x any) bool {
 	}
 	colMatch := c.column.Equals(toMatch.column)
 	valueMatch := reflect.DeepEqual(c.value, toMatch.value)
+	if !valueMatch {
+		// if c.value and toMatch.value are [time.Time] values, we want to compare them within a range.
+		if t1, ok1 := any(c.value).(time.Time); ok1 {
+			if t2, ok2 := any(toMatch.value).(time.Time); ok2 {
+				diff := t1.Sub(t2)
+				if diff < 0 {
+					diff = -diff
+				}
+				// We may want to make [time.Second] configurable in the future
+				valueMatch = diff <= time.Second
+			}
+		}
+	}
 	return colMatch && valueMatch
 }