p11_child: add verification option
    
    With the new option p11_child can be used to verify a certificate given
    on the command line. This will allow the ssh responder to call p11_child
    to verify a certificate instead of doing it on its own. This does not
    only reduce code-duplication but makes sure that the ssh responder is
    not blocked while running OCSP checks.
    
    Related to https://pagure.io/SSSD/sssd/issue/3489
    
    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>