delegation-shell: generate delegated credential of correct type

There are several types of proxy credential.  Currently the delegation shell generates
a fixed type.

In practise, the chain of proxy certificates must be of the same type or some services
will reject the chain.

This patch updates the delegation client so it generates a certificate of the same
type as the most recent (top-most) proxy certificate.

Target: master
Patch: https://rb.dcache.org/r/7112/
Acked-by: Gerd Behrmann
Request: 2.9