[krbdev.mit.edu #7596] PKINIT should allow missing DH param Q

[Tom Yu via RT]

PKINIT should allow the Diffie-Hellman parameters to omit the Q value
if the P value is the modulus of a well-known group.  As noted in

    http://www.rfc-editor.org/errata_search.php?eid=3157

the Q values for the well-known Oakley MODP group numbers 2, 14, and
16 are (P-1)/2.

The DomainParameters ASN.1 type [RFC3279] requires a "q" value, but
Windows 7 (at least) appears to omit it, causing a decode failure in
pkinit_decode_dh_params().  pkinit_check_dh_params() should probably
allow a null "q1" value if everything else checks out.
server_check_dh() might also need similar changes, but it seems to
only be used for draft9 requests.

Found during interop testing, but Reinhard Kugler <rekuread at gmail.com>
also made a separate report.