security/dogtag-pki: bound the rc onestop call during pkidestroy

The Tomcat stop path called service <instance> onestop and blocked on
rc.subr's wait_for_pids() indefinitely when the jsvc/JVM did not exit
(e.g. a wedged webapp during pkidestroy). Bound the call with a timeout
and fall back to SIGKILL so pkidestroy/uninstall can never hang.

Sponsored by: Netzkommune GmbH