Drop our own PKCS#10 ASN.1 decoder and use the one from python-nss

This patch:
- bumps up the minimum version of python-nss
- will initialize NSS with nodb if a CSR is loaded and it isn't already
  init'd
- will shutdown NSS if initialized in the RPC subsystem so we use right db
- updated and added a few more tests

Relying more on NSS introduces a bit of a problem. For NSS to work you
need to have initialized a database (either a real one or no_db). But once
you've initialized one and want to use another you have to close down the
first one.  I've added some code to nsslib.py to do just that. This could
potentially have some bad side-effects at some point, it works ok now.

ipaserver/install/dsinstance.py

@@ -366,7 +366,7 @@ class DsInstance(service.Service):
         self._ldap_mod("ipa-winsync-conf.ldif")
 
     def __config_version_module(self):
-        self._ldap_mod("ipa-version-conf.ldif")
+        self._ldap_mod("version-conf.ldif")
 
     def __user_private_groups(self):
         if has_managed_entries(self.host_name, self.dm_password):