Combine PKINIT test scripts
Clean up and improve PKINIT test script

Don't create a bunch of identically configured realms; just reuse the
same one.  Remove a redundant assignment from the soft-pkcs11.so
check.  Move the pkinit_identity setting from krb5.conf to kdc.conf,
since it's only used by the KDC.  Add a test for trying anonymous
PKINIT when it isn't configured.  Check for a specific error message
when testing restricted anonymous PKINIT.
Allow self-service for kadmin purgekeys RPC

Make the purgekeys RPC allow self-service, like the chpass and chrand
RPCs.

ticket: 7681 (new)
Load cred store functions from GSS modules

When the credential store feature was implement the related functions
were added to struct gss_config, but the initialization function that
dynamically loads modules was not changed to see if the plugin being
loaded provided such functions.

This will allow non-builtin mechanism and interposer mechanism to
implement custom credential store extensions if they wish.

ticket: 7682
Load import/export cred functions from GSS modules

When the import/export credential feature was implement the related
functions were added to struct gss_config, but the initialization
function that dynamically loads modules was not changed to see if
the plugin being loaded provided such functions.

This will allow non-builtin mechanism and interposer mechanism to
implement custom import/export credential extensions if they wish.

ticket: 7682
Don't ask empty responder questions in PKINIT

When putting together the set of identity prompts for a responder
challenge, if we don't need a PIN or password of some kind, don't ask
an empty question.

[ghudson@mit.edu: squashed commits, modified commit message, merged
PKCS11 test with current Python script]