Add a helper to set RSASSA-PSS padding parameters

Add a helper to set RSASSA-PSS padding parameters

This sets the AlgorithmIdentifier's algorithm to id-RSASSA-PSS with
appropriate RSASSA-PSS parameters. This pulls a chunk of code out of
rsa_cms_sign() and rewrites it with proper error checking, thereby
fixing a long-standing leak.

This helper can also be used in rsa_item_sign(), but that part is a
bit special, and will therefore be commmitted separately.

ok jsing