Consider use of Ownable2Step over Ownable

[0x-r4bbit]

There are a few contracts in this repository that inherit from OZ's Ownable and will be deployed by Status.
At the time of writing this issue, these contracts are:

• CommunityTokenDeployer
• OwnerTokenFactory
• MasterTokenFactory

And, if #2 gets extended to use minimal contract proxies within the token factories, then both, OwnerToken and MasterToken contracts will be Ownable as they need to be deployed by Status as templates as well.

The entire system relies on a flawless transfer of ownership, which can be considered a security risk.
If, for whatever reason, Ownable.transferOwnership() is called with the wrong address, all future tokens deployed by community owners could be exploited.

I think we should consider the use of Ownable2Step over Ownable in these cases.
Ownable2Step makes transferring ownership a 2-step process, requiring the new owner to claim the transferred ownership, allowing the original owner to pull back.

Given the discussion happening in OpenZeppelin/openzeppelin-contracts#3620 there seems to be plenty of consensus that Ownable should've behaved like Ownable2Step in the first place. Another reason we should probably favour Ownable2Step over Ownable.

@3esmit what's your take on this?

[3esmit]

The suggestion is an improvement to security, than it should be done. The proposal is to add a fool proof mechanic to the ownership transfer, and it does not hurt any other property of the system, it would only be slightly more expansive in gas, on an uncommon opreation.

[0x-r4bbit]

Thank you for you opinion!
Will prepare a PR for this then!