signature-params: Provide option for maximum RSA/PSS salt length

However, the length now has to be resolved early, so we don't operate on
the negative constant values e.g. when generating the encoding.

src/pki/pki.c

@@ -304,6 +304,7 @@ signature_params_t *get_signature_scheme(private_key_t *private,
 			.scheme = SIGN_RSA_EMSA_PSS,
 			.params = &pss_params,
 		};
+		rsa_pss_params_set_salt_len(&pss_params, 0);
 		scheme = signature_params_clone(&pss_scheme);
 	}
 	else