epass2003: support stricter privkey/pubkey ACLs

The patch allows to use ACLs requring PIN for deleting and updating private and public keys for epass2003. Currently default epass2003 profile has `ACL = *= NONE` for both private and public key files.

Privkey import worked before this patch, but generating failed. 

**Testcase:**

1. In `/usr/share/opensc/epass2003.profile`, change ACL to require PIN for deleting and updating private and public key files 2900, 3000. E.g. by applying this diff to the profile:

        --- epass2003.profile   2013-03-22 14:27:33.815532234 +0100
        +++ epass2003.profile.new       2013-03-22 16:42:16.321706060 +0100
        @@ -164,13 +164,13 @@
         #type  = internal-ef;
                                                structure = 0xA3;
         #ACL = READ=CHV1,UPDATE=CHV1,CRYPTO=CHV1;
        -                                       ACL = *=NONE;
        +                                       ACL = *=NONE,UPDATE=$PIN,DELETE=$PIN;
                                        }
         
                                EF public-key {
                            file-id       = 3000;
                                                structure = transparent;
        -                                       ACL      = *=NONE;
        +                                       ACL                        = *=NEVER,READ=NONE,UPDATE=$PIN,WRITE=$PIN,DELETE=$PIN;
                                }
         
                                # Certificate template

2. Erase card, initialize with onepin profile, generate keypair:

        pkcs15-init -E
        pkcs15-init --create-pkcs15 --profile pkcs15+onepin --label "Generated" --pin 1234 --puk 000000
        pkcs15-init --generate-key rsa/2048 --auth-id 01 -u sign

Generating should now complete successfully. Deleting/updating 29xx and 30xx keyfiles will not be possible without PIN authorization. It can be checked via opensc-explorer's `rm` and `put` commands.