testing: Use pki --ocsp as OCSP responder

The only exception is the ikev2/ocsp-no-signer-cert scenario as the
pki command won't sign an OCSP response with a certificate that isn't
the CA certificate or marked as an OCSP signer.

testing/tests/ikev2/ocsp-no-signer-cert/hosts/winnetou/etc/ca/ocsp/ocsp.cgi

@@ -5,7 +5,8 @@ cd /etc/ca
 echo "Content-type: application/ocsp-response"
 echo ""
 
+# we have to use OpenSSL here as pki --ocsp rejects signing with such a
+# non-OCSP-signer certificate
 cat | /usr/bin/openssl ocsp -index index.txt -CA strongswanCert.pem \
 	-rkey winnetouKey.pem -rsigner winnetouCert.pem \
-	-nmin 5 \
-	-reqin /dev/stdin -respout /dev/stdout | cat
+	-nmin 5 -reqin /dev/stdin -respout /dev/stdout | cat