PKINIT testing: don't always expect responder questions

When testing authenticated (non-anonymous) PKINIT, expect to get a
challenge from PKINIT only when there's a smart card that requires login
or there's a private key that needs to be decrypted.  Add PKCS11 tests
which use an unencrypted key, and check that we also don't produce a
challenge question when using it.
Teach responder test helper to check for "no challenge"

Teach the responder test helper to recognize when we expect that there's
no challenge for a given question name.  For example, when there's no
OTP token info, or no PKINIT identity for which we need a PIN or
password.