p11_child: make OCSP digest configurable
    
    Currently sha1 is used to create the certid for an OCSP request. Since
    sha1 is not recommend for new applications anymore and not FIPS
    compliant this patch changes the default to sha256 and makes the digest
    function configurable as well.
    
    Related to https://pagure.io/SSSD/sssd/issue/4032
    
    Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>
    Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>