Fully general device-independence for two-party cryptography and position verification