Simplify principal access within libkrb5

For conciseness, directly use fields of krb5_principal objects instead
of using the accessor macros.
Avoid passing null pointers to memcpy/memcmp

By a strict reading of the C standard, memcpy and memcmp have
undefined behavior if their pointer arguments aren't valid object
pointers, even if the length argument is 0.  Compilers are becoming
more aggressive about breaking code with undefined behavior, so we
should try to avoid it when possible.

In a krb5_data object, we frequently use NULL as the data value when
the length is 0.  Accordingly, we should avoid copying from or
comparing the data field of a length-0 krb5_data object.  Add checks
to our wrapper functions (like data_eq and k5_memdup) and to code
which works with possibly-empty krb5_data objects.  In a few places,
use wrapper functions to simplify the code rather than adding checks.
Initialize outpos in krb5int_utf8_normalize

After k5memdup0 was slightly modified in
31124ffb81e8c0935403a9fdc169dead5ecaa777, some older versions of gcc
complain about outpos being possibly used before it is initialized.
This can't actually happen, but we can silence the error and also
simplify how outpos is initialized.
Add a script for generating test PKI credentials
Make reassembled PKCS11 names parseable

The reassembled names used "," as a separator between attributes, when
passed-in values use ":".  They weren't intended to be different, so
correct it.
Don't fail if a candidate certificate has no SANs

Don't return an error, which will eventually cause the module to just
return an error, if we don't find any SANs in the candidate certificate:
just return the empty list of values so that processing can continue on
to other certificates.
Add quick docs for KRB5_RESPONDER_QUESTION_PKINIT

Add some examples for KRB5_RESPONDER_QUESTION_PKINIT to the header
files.
Make the text of NSS's prompts look like OpenSSL's

When built with NSS, make the text of prompts that we issue to the user
better mirror the text we use when we build with OpenSSL.
Rename a couple of parameters for readability

We'll be adding another variable named "identity" later, to track the
name of the identity, so go ahead and give "label" and "id" names which
make it clearer that they're not identity names, but attributes of the
identity which were supplied by the caller.
Include an error name in one trace error message

When we fail to sign data, include the name of the library error if
we're built with debugging support.
Only call SEC_PKCS12DecoderFinish() once

We already call SEC_PKCS12DecoderFinish() before entering the switch()
statement, so don't call it again.  Failures to parse PKCS12 data due to
reasons other than not having a decryption password probably didn't end
well before now.
Split pkinit_identity_initialize into two phases

Split part of pkinit_identity_initialize() into a second piece named
pkinit_identity_prompt().  Have each piece pass a new boolean flag to
crypto_load_certs() to indicate if it should defer prompting for a
password or PIN for client identities.  Otherwise, it should go ahead
and use a prompter to prompt for that information.
Traverse tokens like we do with OpenSSL for NSS

When built with NSS, change our token traversal strategy to mimic the
way we do things when we're using OpenSSL: forget about slot names, and
only look at the specified token, or the first one if one isn't
specified.
Add support for tracking deferred identity prompts

Track a list of deferred identities, for which we want to prompt for
passwords or PINs, in pkinit_identity_crypto_context structures, along
with associated warnings.  These are opaque outside of
pkinit_crypto_openssl and pkinit_crypto_nss, so both need to provide
functions that can be called from elsewhere to populate and query the
lists.
Add support for deferred identity prompting

The password callback which we usually supply to NSS already gets a
pointer to the pkinit_identity_crypto_context structure, but it needs to
be passed the name of the identity for which it's being called.

If it gets a name, and it's deferring prompting, just add the identity
to the list of deferred identity prompts, it's not going to be called if
its result is not needed.  Otherwise, check for a password that's been
stashed for its use for that identity, and return a copy of it if it's
found.  If none of that works, try to use the prompter callback.

In various places where we attempt to load identity information, ignore
failures so yield new information if we're deferring prompts.
Add support for deferred identity prompting

Add a password to the set of things that we can pass to a PEM password
callback and the function we use for loading PKCS12 bundles.  If we're
meant to defer identity prompts, just store the name of the identity
which we're loading.  Otherwise, if we're passed a password, use it.
Otherwise, use the prompter callback.

Add a password to the set of things that we can pass to the function
that we use for logging in to PKCS11 tokens, too, but if we're deferring
identity prompts, just return the identity name without doing anything
else.  If not, and we're passed a password, use that.  Otherwise, try to
use the prompter callback to get one.
Pass deferred identity prompts to the responder

Use the list of deferred identity prompts and warnings, which we have
after calling pkinit_identity_initialize(), to build a list of questions
for responder callbacks to answer, and before calling
pkinit_identity_prompt() to actually load identities that are protected,
save any passwords and PINs which a responder callback may have
supplied, in case there's no prompter callback.
Pass token warnings flags to the prompter callback

Interpret the token flags and pass a warning about the state of the
token's PIN to the prompter function as part of prompting for the PIN.
When DEBUG=1, log why we fail to log in to a token
Pass a distinguishable identity name to responders

When using a PKCS#11 token, build an identity name using the token name
and slot ID, and pass that to the password prompter, so that even if the
user or configuration didn't originally specify either, we can be more
sure that we're applying any values we get back to the right token.