Retrofit responder support into the PKINIT module

This patch series breaks up processing of PKINIT client credentials into two phases.  In the first, the names of identities which require a password or PIN for access are recorded, and in the second, identities which weren't loaded during the first phase are loaded.

The responder callback, if one was supplied, will be called between the two phases by the client library, and the prompter callback, if one was supplied, will be called by the PKINIT module during the second phase if no responder-supplied answer is available for a given question.

A helper API which is similar to the krb5_responder_otp_* family of functions is introduced, and the series also adds tests for them and for the new responder challenge directly.

The changes applied aren't particularly pretty.

There's a resource leak that occurs in the NSS implementation when no responder-supplied answer is available for a question, and no prompter callback is available, and as a result krb5_get_init_creds_password() fails.  I haven't been able to pin it down.  The test still succeeds, though, along with the rest.