Initialize ret in process_pa_data

If the for loop never consults any preauth modules and must_preauth is
false, we might never set ret, so we need to initialize it.  The bug
was introduced in 5c23bce0e8d3328bb36bc85ee10cfac486b8ae9b and is
detected by some versions of gcc with -O2.
Remove dangling reference to $with_edirectory
Fix a compiler warning when checking for DH mode

As noted by others, and the compiler, rep->choice can't ever be set to
choice_pa_pk_as_rep_draft9_dhSignedData, so check for it in the correct
structure.
Avoid writing krbLastAdminUnlock during auditing

Try to avoid writing krbLastAdminUnlock when we're just doing auditing
in the KDC.  Because we know that kdb5_ldap_put_principal() only writes
the attribute when it's nonzero, we temporarily reset the value to make
sure that it isn't written.  This approach is a bit of a hack, but it
keeps the number of code paths affected by this change low.
Add an undocumented -x option for responder values

Add an undocumented -x option in the vein of the -X option, which
accepts question/answer pairs to be supplied by a responder callback.
Expected to only ever be useful for testing.
Add quick docs for KRB5_RESPONDER_QUESTION_PKINIT

Add some examples for KRB5_RESPONDER_QUESTION_PKINIT to the header
files.
Make the text of NSS's prompts look like OpenSSL's

When built with NSS, make the text of prompts that we issue to the user
better mirror the text we use when we build with OpenSSL.
Learn to prompt for passwords for PEM files

When we don't supply our own callback to PEM_read_bio_PrivateKey(), the
library uses its own, which interacts with the user via the controlling
terminal.  Here we provide a callback that calls the prompter instead.
Rename a couple of parameters for readability

We'll be adding another variable named "identity" later, to track the
name of the identity, so go ahead and give "label" and "id" names which
make it clearer that they're not identity names, but attributes of the
identity which were supplied by the caller.
Formatting fixup
Include an error name in one trace error message

When we fail to sign data, include the name of the library error if
we're built with debugging support.
Only call SEC_PKCS12DecoderFinish() once

We already call SEC_PKCS12DecoderFinish() before entering the switch()
statement, so don't call it again.  Failures to parse PKCS12 data due to
reasons other than not having a decryption password probably didn't end
well before now.
Use different variables for PEM keys and certs

Use different variables to hold the generic object pointers for
certificates and private keys when we load them, so that we don't lose
track of the certificate while we attempt to load the key.
Split pkinit_identity_initialize into two phases

Split part of pkinit_identity_initialize() into a second piece named
pkinit_identity_prompt().  Have each piece pass a new boolean flag to
crypto_load_certs() to indicate if it should defer prompting for a
password or PIN for client identities.  Otherwise, it should go ahead
and use a prompter to prompt for that information.
Add support for tracking deferred identity prompts

Track a list of deferred identities, for which we want to prompt for
passwords or PINs, in pkinit_identity_crypto_context structures.  These
are opaque outside of pkinit_crypto_openssl and pkinit_crypto_nss, so
both need to provide functions that can be called from elsewhere to
populate and query the lists.
Add support for deferred identity prompting

The password callback which we usually supply to NSS already gets a
pointer to the pkinit_identity_crypto_context structure, but it needs to
be passed the name of the identity for which it's being called.

If it gets a name, and it's deferring prompting, just add the identity
to the list of deferred identity prompts, it's not going to be called if
its result is not needed.  Otherwise, check for a password that's been
stashed for its use for that identity, and return a copy of it if it's
found.  If none of that works, try to use the prompter callback.

In various places where we attempt to load identity information, ignore
failures so yield new information if we're deferring prompts.
Add support for deferred identity prompting

Add a password to the set of things that we can pass to a PEM password
callback and the function we use for loading PKCS12 bundles.  If we're
meant to defer identity prompts, just store the name of the identity
which we're loading.  Otherwise, if we're passed a password, use it.
Otherwise, use the prompter callback.

Add a password to the set of things that we can pass to the function
that we use for logging in to PKCS11 tokens, too, but if we're deferring
identity prompts, just return the identity name without doing anything
else.  If not, and we're passed a password, use that.  Otherwise, try to
use the prompter callback to get one.
Pass deferred identity prompts to the responder

Use the list of deferred identity prompts, which we have after calling
pkinit_identity_initialize(), to build a list of questions for responder
callbacks to answer, and before calling pkinit_identity_prompt() to
actually load identities that are protected, save any passwords and PINs
which a responder callback may have supplied, in case there's no
prompter callback.
Shorten whitespace in the middle of debug messages