Add ability to create Yubikey, SMS second factor

- [x] Translate translation keys
- [x] Document second factor API in [wiki](https://wiki.surfnet.nl/display/stepup/API+Design)
- [x] Decide on consistent usage of Step-up domain value objects in projection entities
  - [x] `\Surfnet\StepupMiddleware\ApiBundle\Identity\Entity\Identity::$institution` has string type hint.
These projectors are off. Iirc, you've been to the meetup on tuesday, where each state transition in model led to a new instance of a different model being created. That is exactly what we must do. 
You've proven possession of a SecondFactor? Then a unverifiedsecondfactor is projected, which has an email nonce.
You've verified your email by clicking on a link? Then the unverifiedSecondFactor projection is removed and a verifiedSecondFactor is projected, which does not have an email-nonce, but does have a registration code. 
You've managed to show proof of possession to an RA, and you have been vetted? The verifiedSecondFactor projection is removed and a Middleware\VettedSecondFactor is projected and a Gateway\SecondFactor is projected.

Projections could be seen as  simple DTOs stored in a database. They represent a certain state of (a part of) an aggregate root. They may not have state or state transitions themselves. They either exist, or they don't. That's how state of the underlying aggregateroot is exposed.