Add PKINIT KDC support for freshness token

Add PKINIT KDC support for freshness token

Send a freshness token in the preauth hint list if PKINIT is
configured and the request padata indicates support.  Verify the
freshness token if the client includes one in a PKINIT request, and
log whether one was received.  If pkinit_require_freshness is set to
true in the realm config, reject non-anonymous requests which don't
contain a freshness token.

Add freshness token tests to t_pkinit.py with some related changes.
Remove client long-term keys after testing password preauth so we get
better error reporting when pkinit_require_freshness is set and a
token is not sent.  Remove ./responder invocations for test cases
which don't ask PKINIT responder questions, or else the responder
would fail now that it isn't being asked for the password.  Leave
anonymous PKINIT enabled after the anonymous tests so that we can use
it again when testing enforcement of pkinit_require_freshness.  Add
expected trace messages for the basic test, including one for
receiving a freshness token.  Add minimal expected trace messages for
the RSA test.

ticket: 8648