Load certs when checking pkinit_identities values

Load certs when checking pkinit_identities values

Move the crypto_load_certs() probe from pkinit_identity_initialize()
to process_option_identity().  This will attempt to load a certificate
for each pkinit_identities value, and if the certificate load fails to
move to the next line.

For PKCS11, return an error if pkinit_open_session() fails, but do not
fail in pkinit_open_session() just because identity prompts are
deferred.

[ghudson@mit.edu: added test case; moved cert probe to
process_option_identity(); rewrote commit message]

ticket: 8984 (new)