Add token support to the renew_ca_cert certmonger helper
    
    The certificates live on the token so need to be retrieved
    from there with the token name. The certificates are visible
    in NSS softoken but operations need to be done on the HSM
    version. The right password is necessary so retrieve it from
    the PKI password store.
    
    Fixes: https://pagure.io/freeipa/issue/9273
    
    Signed-off-by: Rob Crittenden <rcritten@redhat.com>
    Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>