Fix checking plain PKCS12: twice but not plain DIR:
Fix a typo that caused us to try to remove(".")
Don't fail if a candidate certificate has no SANs

Don't return an error, which will eventually cause the module to just
return an error, if we don't find any SANs in the candidate certificate:
just return the empty list of values so that processing can continue on
to other certificates.
Make the text of NSS's prompts look like OpenSSL's

When built with NSS, make the text of prompts that we issue to the user
better mirror the text we use when we build with OpenSSL.
Only call SEC_PKCS12DecoderFinish() once

We already call SEC_PKCS12DecoderFinish() before entering the switch()
statement, so don't call it again.  Failures to parse PKCS12 data due to
reasons other than not having a decryption password probably didn't end
well before now.
Traverse tokens like we do with OpenSSL for NSS

When built with NSS, change our token traversal strategy to mimic the
way we do things when we're using OpenSSL: forget about slot names, and
only look at the specified token, or the first one if one isn't
specified.
When DEBUG=1, log why we fail to log in to a token
NSS: load certificates first

In order to work around RHBZ#859535, when loading a certificate and a
key, switch to loading the certificate first.
Fix loading of certificates

When loading certificates using the PEM module, use a better method for
finding the just-loaded certificate that doesn't break if we've already
got a copy of the certificate somewhere.
NSS: support encrypted PEM keys

When the PEM module is given an encrypted key, it changes its status to
indicate that a password is required.  So if we detect that after
loading a private key, attempt to "log in" to the "token" using a
password.  Even if we fail, we'll have reset the needs-login flag, which
is necessary before we can import anything else.
Candidate fix for some refcounted-resource leaks

* Use PK11_FreeSlot() instead of SECMOD_CloseUserDB() to close a
  database opened with SECMOD_OpenUserDB().
* Fix a typo and use PK11_DestroyGenericObject() instead of
  PK11_DestroyGenericObjects() to destroy one object.
* Use SECMOD_DestroyModule() instead of SECMOD_UnloadUserModule()
  to close a module loaded with SECMOD_LoadUserModule().
* Don't add a second ref that we won't use to the one we already get
  from CERT_FindCertByDERCert().
* crypto_check_for_revocation_information(): don't leak a reference
  to the CRL, or to intermediate issuers.
* Don't leak a reference to a PEM private key.