Add token support to installer certificate handling
    
    Pass along the user-provided password file, if any, to the
    underlying NSS database. This will provide for per-token
    passwords.
    
    If a token is in a nickname then break it out and pass it to
    certutil separately.
    
    Fixes: https://pagure.io/freeipa/issue/9273
    
    Signed-off-by: Rob Crittenden <rcritten@redhat.com>
    Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>