Fixes for PKINIT when built with NSS

A mixture of fixes for pkinit_crypto_nss.c and workarounds for bugs and limitations of NSS's PEM module.  With these applied, and using client and KDC certificates which also include the TLS client and server extended key usages, t_anonpkinit and t_authpkinit succeed on a Fedora 19 system, and debug messages no longer complain about errors attempting to shut down their NSS context.