Combine PKINIT test scripts
Clean up and improve PKINIT test script

Don't create a bunch of identically configured realms; just reuse the
same one.  Remove a redundant assignment from the soft-pkcs11.so
check.  Move the pkinit_identity setting from krb5.conf to kdc.conf,
since it's only used by the KDC.  Add a test for trying anonymous
PKINIT when it isn't configured.  Check for a specific error message
when testing restricted anonymous PKINIT.
Allow self-service for kadmin purgekeys RPC

Make the purgekeys RPC allow self-service, like the chpass and chrand
RPCs.

ticket: 7681 (new)