Several fixes from testing E2E with HSM.

Tested with SoftHSM as well as IBM CEX5S.

- Biggest change: make most pkcs11 operations class-based
   (This is so that multiple CSPs can be instantiated at once.
    This in turn is useful for cryptogen, to generate in multiple
    pkcs11 tokens at once)
- viper.UnmarshalKey ignores ENV vars. Luckily Jason already has
  viperutil that does not
- some further pkcs11 option cleanup,
- implement softverify flag
- implement sensitive flag, since real card prohibits key import

Change-Id: Ic40323f1a32499da0f61ab0658371a1af95c564d
Signed-off-by: Volodymyr Paprotski <vpaprots@ca.ibm.com>