Add support for using a PKCS#11 SmartCard/Token containing a ROOT CA for signing the certificates

This pull request adds full support for creating and using a PKCS#11 smart-card or token which is loaded with a ROOT CA to sign the certificates. Using a token instead of using a file to sign certificates has a huge security advantage as unauthorised copying of the private keys is impossible once it's stored on a smart-card or token.
Needs opensc 0.12+

New features for supporting PKCS#11 SmartCards & Token
<b>--pkcs11-initca</b>
Build a root CA inside a PKCS#11 token and set the authority bit on the certificate. Most software will automatically trust the CA on the token. Advantage is the private key of the CA can never by copied or stolen. Disadvantage, if you break the token you lost the CA.

<b>--pkcs11-loadca</b> 
Load the existing root CA (priv/pub/crt) from the keys directory into a PKCS#11 token

<b>--pkcs11-use-tokenca</b>
Use this in combination with:
  <b><i>clientName</b></i> : Build a new client certificate and sign it with the CA stored in the CA token
  <b><i>--server</b></i>:Build a new server certificate and sign it with the CA stored in the CA token
  <b><i>--sign</b></i>: Sign an existing CSR with the CA stored in the CA token
  <b><i>--inter</b></i>: Build intermediate CA and sign it with the CA stored in the CA token 
  <b><i>--pkcs11</b></i>:generate certificate on PKCS#11 token and sign it with the CA stored in the CA token. It will ask to swap the tokens between the <code>client/server token</code> and the <code>\*CA Token*</code>. You could use them both inserted and figure out which one lives on which slot and enter that as parameters.

<b>Misc</b>
In case of a wrong pin-code was entered or the smart-card reader was not ready yet, it will show the error and will ask again for a retry.

<b>Tested</b>
I've tested it with a Feitian: SCR301, SCR310 smartcard raders and a ePass2003 token

Cheers,
       Wessel