Add code to prevent locking the token by mistake

[simo5]

Description

For tokens that properly report the status of the PIN authentication counter via token flags, check them out and refuse to attempt login if the token is on its last try.

A token should never be on its last try and finding this flags set is an indication that someone may have hardocded an in correct pin in the configuration or an URI. Proceeding would have a high chance of ending up blocking the token.

Fixes: #455

Checklist

• Code modified for feature
• Test suite updated with functionality tests
• Test suite updated with negative tests
• Documentation updated

Reviewer's checklist:

• Any issues marked for closing are addressed
• There is a test suite reasonably covering new functionality or modifications
• This feature/change has adequate documentation added
• Code conform to coding style that today cannot yet be enforced via the check style test
• Commits have short titles and sensible commit messages
• Coverity Scan has run if needed (code PR) and no new defects were found

[Jakuje]

lgtm

[simo5]

@Jakuje I have not added tests for this feature, do you think it is obvious enough, or do you think I should try to create a test? I might be able to do it with kryoptic at least.

[Jakuje]

I think having a test coverage for this would be helpful to be sure it works as expected.

Just something simple trying to login several times using pkcs11 provider and bad pin (different processes so this is not caught by the mechanism preventing relogin with bad pin), then checking it is not locked (for example using pkcs11-tool), then using the right pin in pkcs11 tool and then verifying the functionality again with pkcs11 provider.

[simo5]

Added a test!

[simo5]

So I will push a change soon as -T was not working with tokens with multiple slots as pkcs11-tool was trying to login to each token that way, -I works better to test the login.

However softhsm gets to pin count low and then never locks it (I tried manually some 30/40 login attempts.

While softokn seem to never set even any low count or lock flags at all.

So neither can be tested.