Add PKINIT paChecksum2 from MS-PKCA v20230920

Add PKINIT paChecksum2 from MS-PKCA v20230920

In 2023, Microsoft updated MS-PKCA to add the optional paChecksum2
element in the PKAuthenticator sequence.  This checksum accepts SHA-1,
SHA-256, SHA-384, and SHA-512 digests.

In Windows Server 2025, this checksum becomes mandatory when using
PKINIT with FFDH (but strangely not with ECDH if SHA-1 is configured as
allowed).

[ghudson@mit.edu: refactored crypto interfaces to reduce complexity of
calling code]

ticket: 9166 (new)