Find and delete certificates by arbitrary attributes

[Nicolas-Peiffer]

ImportCertificateWithAttributes exists, but there is no find or delete counterpart. Certificates
can only be located and removed by id, label and serial, through FindCertificate and
DeleteCertificate. Keys have the full set — FindKeyPairsWithAttributes,
FindKeysWithAttributes, FindPrivateKeysWithAttributes, FindRSAKeyPairsWithAttributes — so the
gap is specific to certificates.

Proposed:

func (c *Context) FindCertificateWithAttributes(template AttributeSet) (*x509.Certificate, error)
func (c *Context) DeleteCertificateWithAttributes(template AttributeSet) error

Both were originally proposed by @al1img in #83, alongside the certificate chain lookup. The chain
half is now implemented (#91); these two are unrelated to chains and were deliberately left out of
that work, since adding public API is its own decision rather than something to carry in on a
chain-lookup change.

Groundwork

findX509Certificates in certificates.go already takes an arbitrary attribute template, adds
CKA_CLASS and CKA_CERTIFICATE_TYPE itself, pages C_FindObjects and parses CKA_VALUE
tolerantly. FindCertificateWithAttributes is a thin wrapper over it plus AttributeSet.ToSlice().

To settle when implementing

• FindCertificate returns the first match. Should the attribute finder do the same, or should
  there be a plural FindCertificatesWithAttributes returning every match, as the key finders do?
  The singular alone is the odd one out again.
• DeleteCertificate deletes only the first match. Same question, and here deleting more than the
  caller expected is the more dangerous failure mode of the two.
• Whether an empty template should be rejected. Unlike the key finders, an empty template on the
  delete path means every certificate on the token, which is not a plausible request to honour
  silently.

API impact

Additive. Two new methods, no change to any existing signature or behaviour, so this is a v2.1
candidate rather than something the v2.0.0 boundary forces.