Add logic for SCEP renewal with key change
Add logic to the SCEP submission helper to always check the server
capabilities before sending an enrollment request, and to try to use the
Renewal feature when we're rekeying. Add an option to force treating
rekey operations as if they were initial enrollments, and teach the
getcert add-scep-ca command about it.