Support max attempts for pins that prompt for input

[frasertweedale]

Currently the clevis pwd pin prompts forever. It does not terminate
on ^C or give up on empty input. This is reasonable behaviour for
early boot (disk unlock) use case but we need a way to limit
the number of attempts for other use cases, e.g. TLS private keys.

We could either add an "attempts" field in the JSON, understood by
"pwd" pin, or use an envvar. Maybe there are other options.

Other pins would probably want the same option, e.g. a TOTP pin.