p11_child: return multiple certs
    
    This patch refactors the handling of certificates in p11_child. Not only
    the first but all certificates suitable for authentication are returned.
    The PAM responder component calling p11_child is refactored to handle
    multiple certificate returned by p11_child but so far only returns the
    first one to its callers.
    
    Related to https://pagure.io/SSSD/sssd/issue/3560
    
    Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>
    Tested-by: Scott Poore <spoore@redhat.com>