Eliminate redundant PKINIT responder invocation

Eliminate redundant PKINIT responder invocation

In pkinit_client_prep_questions(), only act if the input padata type
is KRB5_PADATA_PK_AS_REQ.  Otherwise we will ask questions again when
the KDC issues a ticket.

Commit 7621d2f9a87214327ca3b2594e34dc7cea84596b (ticket 8242)
unintentionally changed the behavior of pkinit_load_fs_cert_and_key(),
causing pkinit_client_prep_questions() to do nothing on its first
call.  Restore the original behavior of returning 0 when prompting is
deferred.

Modify the existing "FILE identity, password on key (responder)"
PKINIT test to check that the responder is only invoked once.

ticket: 8885