Bypass securid_decrypt_seed() sanity checks when testing device IDs

securid_decrypt_seed() will abort immediately if the token requires a
password but a password isn't provided.  This is *usually* what we want,
but when we're just trying to guess the bound device ID it causes
the function to return prematurely.  In this case we will pass in "." as
the password so that we can see whether the devid hash check returns
ERR_BAD_DEVID or (anything else).

This is still safe on passwordless tokens, because in that case the logic
just ignores the supplied password.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
cli: Add --qr and --show-qr export options

These just invoke external utilities (qrencode and image viewers) but
it is more convenient than remembering the long-ish command lines needed
to convert a token into a QR code.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
man: Update documentation

Update QR info; fix formatting and TODO list.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>