Don't fail if a candidate certificate has no SANs

When we're doing certificate matching and we're asked for the list of
SAN values for a certifiate, and it contains none, don't return an
error, which will eventually cause the module to just return an error.
Instead, just return an empty list of SAN values so that processing will
continue on to check if other certificates match.
Make the text of NSS's prompts look like OpenSSL's

When PKINIT is built with NSS, make the text of prompts that we issue to
the user better match the text we use when we build with OpenSSL: ask
for a pass phrase when we're asking about a hardware token, ask for a
password the rest of the time, and take advantage of translations for
both types of prompts if they're available.
Only call SEC_PKCS12DecoderFinish() once

We already call SEC_PKCS12DecoderFinish() before entering the switch()
statement, so don't call it again.
Traverse tokens like we do with OpenSSL for NSS

When PKINIT is built with NSS, change how it traverses tokens to match
the way it's done when built using OpenSSL: ignore slot names, and
either only look at the specified token, or the first token if a token
name isn't specified.
When DEBUG=1, log why we fail to log in to a token

Use PORT_ErrorToName() to let us print an error name instead of an error
code in a couple of debug messages, since in practice we just end up
looking up the code in <secerr.h> anyway.
NSS: load certificates first

When using NSS's CMS API to generate signed-data messages, we identify
the key that we want to use for signing by specifying a corresponding
certificate.  The library then looks up the corresponding private key
when it gets to the point where it needs the key.  This lookup fails if
a certificate and a its corresponding private key were loaded key-first,
but succeeds if they were loaded certificate-first (RHBZ#859535).  To
work around this, switch to loading the certificate first.
Get better at locating the just-loaded certificate

When loading certificates using the PEM module, use a better method for
finding the just-loaded certificate that will still work if we've
already got a copy of the certificate loaded somewhere else.
NSS: support encrypted PEM keys

When the PEM module is given an encrypted key, it changes its token
flags to indicate that a password is required (by setting needs-login)
to signal the application that we need to supply a password to decrypt
it.  Attempts to load any other items will fail while this flag is set.

If we detect that the flag is set after we've attempted to load a
private key, attempt to "log in" to the "token" using a password.  Even
if we fail, the token will reset its needs-login flag, which is
necessary before we can import anything else.
Fixes for leaking of refcounted resources

Some fixes, some use of different APIs which seem to clean things up
better, with the goal of being able to cleanly shut down NSS when we're
done using it.

* Use PK11_FreeSlot() instead of SECMOD_CloseUserDB() to close a
  database opened with SECMOD_OpenUserDB().
* Fix a typo and use PK11_DestroyGenericObject() instead of
  PK11_DestroyGenericObjects() to destroy one object.
* Use SECMOD_DestroyModule() instead of SECMOD_UnloadUserModule()
  to close a module loaded with SECMOD_LoadUserModule().
* Don't add a second ref that we won't use to the one we already get
  from CERT_FindCertByDERCert().
* crypto_check_for_revocation_information(): don't leak a reference
  to the CRL, or to intermediate issuers.
* Don't leak a reference to a PEM private key.