Properly handle PKCS11 label in PKINIT

The CK_TOKEN_INFO label field is defined to be zero-filled, but it may
not be zero-terminated if all bytes of the field are used.  Use only
length-counted operations to process it.  Also avoid underrunning the
buffer pointer if the label is empty or contains only whitespace.

ticket: 7917
target_version: 1.12.2
tags: pullup
Fix uninitialized variable bug in KEYRING ccache

Commit 5f4a4d7d357fedac5feadc65c09ecf487ff98db8 removed the only
unconditional assignment of ret in get_time_offsets, causing the
function to return an uninitialized value if nothing goes wrong.
Initialize ret at declaration time to fix this.
Unlocked db2 KDB iteration

Try to make an optional db2 iterator that unlocks (and therefore
closes) the KDB between iterations, to allow large KDBs to be dumped
without blocking writes for a long time.

This is a hackish proof of concept.  It won't work for all consumers
of db_iterate, especially ones that need to hold other locks while
iterating.