Wagtail 74 maintenance

[nickmoreton]

Summary

Maintenance release adding Wagtail 7.4 (LTS) + Django 6.0 support, dropping legacy compatibility code, and refreshing the test/CI/dev tooling. Targets Wagtail 7.0–7.4 and Django 5.2–6.0; users still on Wagtail 7.0 / Django 4.2 should stay on wagtail-2fa 1.8.x.

I realise this is a lot of changes, feel free to push back on this PR and make suggestions. We've been using our own forked branch here: https://github.com/torchbox-forks/wagtail-2fa/tree/stable/1.8.2 for some time and essentially this builds of that work.

Compatibility & packaging (setup.py)

• Require Django>=5.2 and Wagtail>=7.0 (with documented upper bounds Django<7, Wagtail<8).
• Remove the vestigial six install dependency (unused since the Py2 shim was dropped).
• Update classifiers: drop Django 3.2/4.1/4.2 and Wagtail 2/3/4; add Django 5.2/6.0, Wagtail 7, and Python 3.12/3.13/3.14.
• Bump dev/test/docs tooling floors (sphinx, pytest, coverage, flake8, isort, etc.).

Application code

• wagtail_hooks.py — Replace deprecated UserListingButton with wagtail.admin.widgets.Button on Wagtail ≥ 7.1 (falls back to UserListingButton below 7.1). Collapse the dual Wagtail 6.0 register_user_listing_buttons branches into a single signature. Convert re_path device URLs to modern path() with <int:...> converters.
• views.py — Drop the DJANGO_VERSION / WAGTAIL_VERSION import guards; import RedirectURLMixin directly and always use the single otp_form.html template (Django < 4.1 and Wagtail < 6.0 branches are now unreachable).
• middleware.py — Add get_allowed_url_names() so the allowed-URL list is extensible via the new WAGTAIL_2FA_ALLOWED_URL_NAMES setting.

Templates

• Delete the legacy legacy/otp_form.html and the otp_form_v6.html variants; consolidate into a single otp_form.html that extends wagtailadmin/base.html, uses the {% formattedfield %} tag, and replaces the GET "Sign out" link with a POST logout button (Django 5.0 removed GET logout support).
• device_list.html — Update the "New device" button to the current Wagtail icon/markup pattern.

Testing & CI

• tox.ini — Expand matrix to Python 3.10–3.14 across Django 5.2/6.0 and Wagtail 7.0/7.3/7.4 (LTS + current + previous).
• Bump actions/setup-python to v6.2.0 in the tox and release workflows.
• Update ignored dependency versions in dependabot.yml.

Sandbox & docs

• sandbox/requirements.txt — Bump to Django>=5.2, Wagtail>=7.0, django-debug-toolbar==6.2.0.
• sandbox — Modernize URLs to path() and remove the removed USE_L10N setting.
• README.rst — Bump sandbox Python guidance to 3.10+.
• CHANGES — Add an Unreleased section documenting the above.