Fix unlikely double free in PKINIT client code

In pa_pkinit_gen_req, if the cleanup handler is reached with non-zero
retval and non-null out_data, out_data is freed, then dereferenced,
then freed again.  This can only happen if one of the small fixed-size
malloc requests fails after pkinit_as_req_create succeeds, so it is
unlikely to occur in practice.

ticket: 7878 (new)
target_version: 1.12.2
tags: pullup
Improve PKINIT client memory management

In pkinit_as_req_create, create and encode stack-allocated auth-pack
structures containing only alias pointers, instead of heap-allocated
structures containing a mix of alias pointers, owner pointers, and
appropriated caller memory.  Keep everything we temporarily allocate
in separate local variables and free them through those variables.

In pa_pkinit_gen_req, use safer memory practices to avoid problems
like issue #7878.  Free the checksum since pkinit_as_req_create no
longer takes ownership it.  Remove a broken overly defensive check
after calling pkinit_as_req_create.

Remove init_krb5_auth_pack and init_krb5_auth_pack_draft9 as they are
no longer required.