Use the safe idiom of cleaning sensitive data from memory with explicit_bzero,
instead of relying on other methods, after readpassphrase. Some programs on
this diff won't benefit that much since it happens near the terminal path, but
someone might copy the unsafe idiom to another program and place it where it
may leak sensitive data.

Discussed aeons ago with tb@, OK deraadt@ and beck@

tokenadm(8) is already pledged, do the same for tokeninit(8).
- bring comment in both programms in line
- tokeninit(8) needs "tty" for readpassphrase(3)
- call token_init() after pledge(2)
- fix whitespace
OK millert@

hexidecimal -> hexadecimal

assign pointers to NULL rather than 0

clean up flags++ instances around getopt()
ok florian

Replace <sys/param.h> with <limits.h> and other less dirty headers where
possible. Annotate <sys/param.h> lines with their current reasons. Switch
to PATH_MAX, NGROUPS_MAX, HOST_NAME_MAX+1, LOGIN_NAME_MAX, etc. Change
MIN() and MAX() to local definitions of MINIMUM() and MAXIMUM() where
sensible to avoid pulling in the pollution. These are the files confirmed
through binary verification.
ok guenther, millert, doug (helped with the verification protocol)

an ellipsis is not an optional argument.

simplify synopsis/usage() and sort options;
from Igor Sobrado

unsigned to unsigned int

Remove \n from err/errx/warn/warnx().

millert@ ok

getopt(3) returns -1 when out of args, not EOF.

millert@ ok

use arc4random, clear secrets, use readpassphrase in tokeninit; ok millert@

Commands for manipulating the token database (ActivCard, CRYPTOCard, or SNK-004)
from BSDi. Will be enabled when BSD authentication is turned on (login_token).