Try harder to find PKCS#11 key to match a given cert
Try harder to find PKCS#11 key to match a given cert

CKA_LABEL might not match, but CKA_ID should. So if the label (of the cert)
was in the original search criteria, but the ID wasn't, then as a last
resort try *dropping* CKA_LABEL from the URI and adding the CKA_ID of the
cert.

Now it works to use a PIV card with something simple like
openconnect -c 'pkcs11:object=Certificate%20for%20PIV%20Authentication'

Also allow ;object-type=cert to be specified for the certificate. We're
clever enough to work out that a key needs to have that changed...

Signed-off-by: David Woodhouse <b460d66aaf00c296a3db1c1d9eeafc081d5f7d70@intel.com>

don-johnny/openconnect,atyndall/openconnect,cernekee/openconnect,lins05/openconnect,lins05/openconnect,nmav/openconnect-mine,brandt/openconnect,matlockx/openconnect,nmav/openconnect-mine,atyndall/openconnect,mtmiller/openconnect,mveplus/openconnect-client,liiir1985/openconnect,matlockx/openconnect,liiir1985/openconnect,cernekee/openconnect,nmav/openconnect-mine,mveplus/openconnect-client,mveplus/openconnect-client,cernekee/openconnect,matlockx/openconnect,lins05/openconnect,brandt/openconnect,mtmiller/openconnect,don-johnny/openconnect,mveplus/openconnect-client,nmav/openconnect-mine,brandt/openconnect,mtmiller/openconnect,don-johnny/openconnect,atyndall/openconnect,atyndall/openconnect,brandt/openconnect,lins05/openconnect,cernekee/openconnect,matlockx/openconnect,liiir1985/openconnect,liiir1985/openconnect,don-johnny/openconnect,mtmiller/openconnect