2FA scratch token includes ambiguous characters

[abackstrom]

• Gitea version (or commit ref): 1.7.3
• Git version: n/a
• Operating system: Ubuntu 16.04
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No
  • Not relevant
• Log gist: n/a

Description

It's possible for the 2FA scratch token to use ambiguous sans-serif characters in the message box, e.g. a lowercase L and an uppercase i. This isn't a problem when copy/pasting, but can present a problem for users who back up scratch tokens using a paper method.

A monospace or other serif font might be a better choice for the token.

Screenshots

Screenshot showing an uppercase i and a lowercase L on Firefox 66.0b13 in Windows 10:

[SagePtr]

Probably they should be formed from Base32 alphabet (but should be slight longer to retain same security as old one)