Add non-JSON APIs for PKINIT responder items

Add wrappers for the JSON-oriented APIs for PKINIT responder items,
modeled after the API we provide for OTP items:
* krb5_responder_pkinit_get_challenge() returns the list of identities
  for which we need PINs
* krb5_responder_pkinit_set_answer() sets the answer to the PIN for one
  of the identities (warning: this way, only one response goes back)
  We might want to change this one to provide a way of providing
  multiple PINs before committing to it.
* krb5_responder_pkinit_challenge_free() frees the structure that was
  returned by krb5_responder_pkinit_get_challenge()
Add a script for generating test PKI credentials