p11: allow p11_child to run completely unprivileged
    
    To only operation of p11_child which requires special privileges is the
    communication to pcscd which handles the Smartcard access. pcscd uses
    policy-kit for access control so access can easily be configured by
    dropping config snippets into the right directory.
    
    If SSSD is configured to run as un-privileged user this patch creates
    the needed config snippet for policy-kit and installs it in a suitable
    directory. As a result p11_child does not have to be installed with
    SETUID or SETGID bits set.
    
    Resolves https://fedorahosted.org/sssd/ticket/2755 by making it obsolete
    
    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>