Add non-JSON APIs for PKINIT responder items

Add wrappers for the JSON-oriented APIs for PKINIT responder items,
modeled after the API we provide for OTP items:

* krb5_responder_pkinit_get_challenge() returns the list of
  identities for which we need PINs
* krb5_responder_pkinit_challenge_free() frees the structure that
  was returned by krb5_responder_pkinit_get_challenge()
* krb5_responder_pkinit_set_answer() sets the answer to the PIN for
  one of the identities

We might want to change krb5_responder_pkinit_set_answer() to provide a
way of providing multiple PINs before committing to it.
Add a helper for checking responder challenges

This test helper takes multiple options and one argument.

./misc/test_responder [options] principal
 -X preauth_option -> preauth options, as for kinit
 -x challenge      -> expected responder challenge, of the form
                      "question=challenge"
 -r response       -> provide a reponder answer, in the form "question=answer"
 -c                -> print the pkinit challenge
 -p identity=pin   -> provide the pkinit answer, in the form "identity=pin"
 principal         -> client principal name

If the responder callback isn't called, that's treated as an error.
If the responder callback is called and the challenge associated with
the specified question doesn't parse as JSON, a literal string compare
is done, otherwise both values are parsed as JSON and then re-encoded
before comparison.  In either case, the comparison must succeed.  Any
missing data or mismatches are treated as errors.
Add various PKINIT-with-responder tests