Add button to explicitly generate backup codes

[iandunn]

If you visit the Backup Codes screen for the first time, the codes are generated automatically, even if the user doesn't intend to (they may just be exploring the feature, and not ready to permanently save the codes, etc). That worsens the effects of WordPress/two-factor#507.

We could add a button as the first step, so we at least know the user intends to generate codes (if not save them). It seems like a bad practice to take an action that modifies their account without an explicit direction.

We could provide a way to disable backup codes so they can undo an accidental generation, but it's important to have them to prevent getting locked out of their account. If we do that, we should probably disable all 2FA providers, and make it very clear to them that we've done that and they'll need to set it up again.

Related #256