Add a helper for checking responder challenges

This test helper takes multiple options and one argument.

./misc/test_responder [options] principal
 -X preauth_option -> preauth options, as for kinit
 -x challenge      -> expected responder challenge, of the form
                      "question=challenge"
 -r response       -> provide a reponder answer, in the form "question=answer"
 -c                -> print the pkinit challenge
 -p identity=pin   -> provide the pkinit answer, in the form "identity=pin"
 principal         -> client principal name

If the responder callback isn't called, that's treated as an error.
If the responder callback is called and the challenge associated with
the specified question doesn't parse as JSON, a literal string compare
is done, otherwise both values are parsed as JSON and then re-encoded
before comparison.  In either case, the comparison must succeed.  Any
missing data or mismatches are treated as errors.
Add various PKINIT-with-responder tests