Determine logic for health provider code logic

[wichert]

Possible approaches:

• code is random generated, and we log timestamp + health provider uid on code generation. This allows generating many in advance, but only per health provider. May be hard to scale.
• generate random single code on-demand, and log timestamp + health provider uid on generation
• use something like TOTP with a time step of 12 hours, leading to codes being valid for 4 days. No way to tie health provider to code? Theoretically we could support offline code generation with this approach, but that requires building an app.
• use TOTP + health provider uid + HMAC of previous two