ceremony: accept path to pkcs11 creds file

An intermediate ceremony config file currently starts like:

ceremony-type: intermediate
pkcs11:
  module: /usr/lib/x86_64-linux-gnu/softhsm/libsofthsm2.so
  pin: 1234
  signing-key-slot: 1307844626
  signing-key-label: Root YE

However, that module path differs on dev machines and ceremony machines, the pin is obviously fake, and the signing key slot is hsm-client dependent. So all of those values have to be rewritten for the actual ceremony, which removes much of the value of preparing and reviewing ceremony inputs ahead of time.

Instead, it would be nice if it could look more like how the CA connects to the online HSM:

ceremony-type: intermediate
pkcs11:
  file: path/to/int.pkcs11.json

This would make it much easier for the pre-prepared configs to exactly match the final configs, and for those configs to never contain actual credentials.

Start by tracing how intermediate ceremony configuration reads the current pkcs11 module, pin, signing-key-slot, and signing-key-label values, then compare it with the CA's existing online-HSM configuration that uses a credentials file. Done means the intermediate ceremony accepts a pkcs11.file path and avoids requiring credentials in the ceremony config.