Add support for deferred identity prompting

Add a password to the set of things that we can pass to a PEM password
callback and the function we use for loading PKCS12 bundles.  If we're
meant to defer identity prompts, just store the name of the identity
which we're loading.  Otherwise, if we're passed a password, use it.
Otherwise, use the prompter callback.

Add a password to the set of things that we can pass to the function
that we use for logging in to PKCS11 tokens, too, but if we're deferring
identity prompts, just return the identity name without doing anything
else.  If not, and we're passed a password, use that.  Otherwise, try to
use the prompter callback to get one.
Pass deferred identity prompts to the responder

Use the list of deferred identity prompts and warnings, which we have
after calling pkinit_identity_initialize(), to build a list of questions
for responder callbacks to answer, and before calling
pkinit_identity_prompt() to actually load identities that are protected,
save any passwords and PINs which a responder callback may have
supplied, in case there's no prompter callback.
Pass token warnings flags to the prompter callback

Interpret the token flags and pass a warning about the state of the
token's PIN to the prompter function as part of prompting for the PIN.
When DEBUG=1, log why we fail to log in to a token
Pass a distinguishable identity name to responders

When using a PKCS#11 token, build an identity name using the token name
and slot ID, and pass that to the password prompter, so that even if the
user or configuration didn't originally specify either, we can be more
sure that we're applying any values we get back to the right token.
Rework loading of PEM credentials

Change the way the NSS implementation loads PEM-format credentials:
* When loading a certificate and a key, switch to loading the
  certificate first, to work around a bug in the PEM module.
* Support encrypted keys.
* Be smarter about finding the certificate after we've loaded it.
Add non-JSON APIs for PKINIT responder items

Add wrappers for the JSON-oriented APIs for PKINIT responder items,
modeled after the API we provide for OTP items:

* krb5_responder_pkinit_get_challenge() returns the list of
  identities for which we need PINs
* krb5_responder_pkinit_challenge_free() frees the structure that
  was returned by krb5_responder_pkinit_get_challenge()
* krb5_responder_pkinit_set_answer() sets the answer to the PIN for
  one of the identities

We might want to change krb5_responder_pkinit_set_answer() to provide a
way of providing multiple PINs before committing to it.
Add a helper for checking responder challenges

This test helper takes multiple options and one argument.

./misc/test_responder [options] principal
 -X preauth_option -> preauth options, as for kinit
 -x challenge      -> expected responder challenge, of the form
                      "question=challenge"
 -r response       -> provide a reponder answer, in the form "question=answer"
 -c                -> print the pkinit challenge
 -p identity=pin   -> provide the pkinit answer, in the form "identity=pin"
 principal         -> client principal name

If the responder callback isn't called, that's treated as an error.
If the responder callback is called and the challenge associated with
the specified question doesn't parse as JSON, a literal string compare
is done, otherwise both values are parsed as JSON and then re-encoded
before comparison.  In either case, the comparison must succeed.  Any
missing data or mismatches are treated as errors.
Add various PKINIT-with-responder tests