Don't fail if a candidate certificate has no SANs

Don't return an error, which will eventually cause the module to just
return an error, if we don't find any SANs in a candidate certificate:
just return the empty list of values so that processing can continue on
to other certificates.
Make the text of NSS's prompts look like OpenSSL's

When built with NSS, make the text of prompts that we issue to the user
better mirror the text we use when we build with OpenSSL: ask for a pass
phrase when it's a hardware token, and a password the rest of the time,
and take advantage of translations for both types of prompts.
Only call SEC_PKCS12DecoderFinish() once

We already call SEC_PKCS12DecoderFinish() before entering the switch()
statement, so don't call it again.  Failures to parse PKCS12 data due to
reasons other than not having a decryption password probably didn't end
well before now.
Traverse tokens like we do with OpenSSL for NSS

When built with NSS, change our token traversal strategy to mimic the
way we do things when we're using OpenSSL: ignore slot names, and either
only look at the specified token, or the first token if a token name
isn't specified.
When DEBUG=1, log why we fail to log in to a token

Use PORT_ErrorToName() to let us print an error name instead of an error
code, which we'd just end up looking up in <secerr.h> anyway.
NSS: load certificates first

In order to work around RHBZ#859535, when loading a certificate and a
key, switch to loading the certificate first so that the PEM module can
figure out that they're related.  That will allow the CMS APIs to locate
the private key that corresponds to a certificate that we're using to
identify the desired signer for a signed-data message.
Get better at locating the just-loaded certificate

When loading certificates using the PEM module, use a better method for
finding the just-loaded certificate that doesn't break if we've already
got a copy of the certificate loaded somewhere else.
NSS: support encrypted PEM keys

When the PEM module is given an encrypted key, it changes its status to
indicate that a password is required to signal that we need to supply a
password to decrypt it.  If we detect that that's happened after loading
a private key, attempt to "log in" to the "token" using a password.
Even if we fail, we'll have reset the needs-login flag, which is
necessary before we can import anything else.
Fixes for leaking of refcounted resources

Some fixes, some use of different APIs which seem to clean things up
better, with the goal of being able to cleanly shut down NSS when we're
done using it.

* Use PK11_FreeSlot() instead of SECMOD_CloseUserDB() to close a
  database opened with SECMOD_OpenUserDB().
* Fix a typo and use PK11_DestroyGenericObject() instead of
  PK11_DestroyGenericObjects() to destroy one object.
* Use SECMOD_DestroyModule() instead of SECMOD_UnloadUserModule()
  to close a module loaded with SECMOD_LoadUserModule().
* Don't add a second ref that we won't use to the one we already get
  from CERT_FindCertByDERCert().
* crypto_check_for_revocation_information(): don't leak a reference
  to the CRL, or to intermediate issuers.
* Don't leak a reference to a PEM private key.